Home / Technology / macOS Root Exploit: VNC Flaw Allows File Creation
macOS Root Exploit: VNC Flaw Allows File Creation
4 Aug
Summary
- macOS RCE flaw allowed root file creation via legacy VNC.
- Apple patched vulnerability on July 27, 2026, in new macOS versions.
- Users advised to disable Screen Sharing or legacy VNC option.
Apple has issued a critical security update to address a remote code execution (RCE) vulnerability affecting specific macOS versions. The flaw, identified as CVE-2026-43760, was discovered by security researchers at Bynario. It enabled threat actors to create files with root privileges on vulnerable Macs by exploiting a legacy VNC password option.
The vulnerability required an attacker to obtain the VNC password and authenticate to the affected Mac. Once connected, they could leverage a logic flaw to perform file operations as root, including creating files in sensitive system directories. Researchers demonstrated gaining passwordless sudo privileges by creating a file in /private/etc/sudoers.d.
Apple released the patch on July 27, 2026, in macOS Tahoe 26.6 and macOS Sonoma 14.8.8. Users who cannot immediately update are strongly advised to disable the legacy VNC setting or turn off Screen Sharing and Remote Management entirely to mitigate the risk.
