Apple Patches Critical macOS Screen-Sharing Flaw Used for Crypto Mining

Apple released a series of security updates for macOS Sonoma, Sequoia, and Tahoe to address a critical screen-sharing vulnerability identified as CVE-2026-65400. The flaw resulted from improper authentication and state management, allowing network attackers to bypass credentials to view a user's screen and control the keyboard and mouse.

The National Cyber Security Centre of the Netherlands reported that the vulnerability was actively exploited on systems where port 5900 was accessible from the internet. Attackers used this access to gain root privileges and install Monero cryptocurrency miners on compromised machines. Apple patched the issue on August 6 with macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.

Following the initial fix, Apple released macOS Tahoe 26.6.2 on August 17, 2026. This subsequent update addressed approximately 28 other vulnerabilities across the Kernel, WebKit, Audio, ImageIO, and IOGPUFamily to mitigate risks of arbitrary code execution and memory corruption. These rapid releases come as the company prepares for the launch of macOS Golden Gate later in 2026, which will end support for Intel-based Macs.