A feature designed to let people remotely control a Mac has become an entry point for attackers.

The Netherlands’ National Cyber Security Centre (NCSC-NL) says threat actors have exploited a recently patched macOS Screen Sharing vulnerability on multiple internet-accessible systems. In each reported case, the attackers obtained root-level access and installed a Monero cryptocurrency miner.

The vulnerability, tracked as CVE-2026-65400, can let a remote attacker bypass authentication and access Screen Sharing without credentials. Apple fixed the flaw on Aug. 6 in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.

Key takeaways

• CVE-2026-65400 lets attackers bypass authentication on Macs with Screen Sharing enabled
• NCSC-NL…