CVE-2026-65400
published 2026-08-06CVE-2026-65400: An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9…
PriorityP181critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-08-21
Exploited in the wild
EPSS
1.72%
77.3th percentile
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | < 14.8.9 | 14.8.9 |
| apple | macos | < 15.7.9 | 15.7.9 |
| apple | macos | < 26.6.1 | 26.6.1 |
| apple | macos | < 26.7 | 26.7 |
| apple | macos | < 27 | 27 |
| apple | macos | >= 14.0 < 14.8.9 | 14.8.9 |
| apple | macos | >= 15.0 < 15.7.9 | 15.7.9 |
| apple | macos | >= 26.0 < 26.6.1 | 26.6.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck7.1HIGH
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Apple macOS Improper Authentication Vulnerability
cisa·2026-08-18·CVSS 9.8
CVE-2026-65400 [CRITICAL] CWE-287 Apple macOS Improper Authentication Vulnerability
Vulnerability: Apple macOS Improper Authentication Vulnerability
Affected: Apple macOS
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://support.apple.com/en-u
GHSA
An authentication issue was addressed with improved state management.
ghsa_unreviewed·2026-08-07
CVE-2026-65400 An authentication issue was addressed with improved state management.
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
VulDB
Apple macOS up to 14.8.8/15.7.8/26.6.0 Screen Sharing improper authentication
vuldb·2026-08-07
CVE-2026-65400 [CRITICAL] Apple macOS up to 14.8.8/15.7.8/26.6.0 Screen Sharing improper authentication
A vulnerability was found in Apple macOS up to 14.8.8/15.7.8/26.6.0. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Screen Sharing. This manipulation causes improper authentication.
This vulnerability is handled as CVE-2026-65400. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is recommended.
VulnCheck
Apple macos Improper Authentication
vulncheck·2026·CVSS 7.1
CVE-2026-65400 [HIGH] Apple macos Improper Authentication
Apple macos Improper Authentication
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
Affected: Apple macos
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://advisories.ncsc.nl/2026/ncsc-2026-0280.html
Elastic
SSFileCopySender Executed as Root
elastic_rules·CVSS 9.8
CVE-2026-65400 [CRITICAL] SSFileCopySender Executed as Root
SSFileCopySender Executed as Root
Identifies execution of the macOS Screen Sharing file-copy helper SSFileCopySender with root UID/GID attributes
(0 80). Under the native Apple authentication path this helper runs in the connecting user's context; execution as
root is anomalous and consistent with pre-authentication exploitation of the Screen Sharing service (CVE-2026-65400),
where a flawed SRP validation path lets an unauthenticated attacker reach privileged file operations. Note that the
0/80 UID/GID pair reflects only initial exploitation attempts and can be evaded once an attacker enumerates another
local account. It is advisable to treat this as a tripwire and pair it with
the SSFileCopyReceiver Writing to Common Persistence Locations rule coverage.
Query:
from logs-endpoint.events
Elastic
SSFileCopyReceiver Writing to Common Persistence Locations
elastic_rules·CVSS 9.8
CVE-2026-65400 [CRITICAL] SSFileCopyReceiver Writing to Common Persistence Locations
SSFileCopyReceiver Writing to Common Persistence Locations
Identifies the macOS Screen Sharing file copy helper SSFileCopyReceiver creating or modifying files in
common persistence locations, including system-wide and per-user LaunchDaemons/LaunchAgents, shell profiles,
SSH authorized_keys, cron tabs, and hidden paths under root's home directory. SSFileCopyReceiver performs file writes
with root authority on behalf of a remote viewer.Pre-authentication exploitation of the Screen Sharing service (CVE-2026-65400)
abuses this write primitive to establish persistence; observed in-the-wild activity dropped LaunchDaemons and
modified shell startup files to run a cryptocurrency miner as root.
Query:
from logs-endpoint.events.file-* METADATA _id, _index, _version
| WHERE host.os.type == "macos"
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
blogs_hackernews·2026-09-21·CVSS 10.0
CVE-2026-76460 [CRITICAL] ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
A browser. A plugin. A package. A login screen. Normal stuff. That is basically the problem this week.
The trouble keeps showing up inside things people already trust: code that takes a bad turn, old payloads coming back, exposed systems, weak checks, fake fixes, and attack paths that look almost too easy. Even the research side is getting messy, with more findings, more automation, and not always more clarity.
Nothing here needs much drama. Just a lot of small doors left open. Here’s what happened.
## ⚡ Threat of the Week
C
Sans Isc
Apple Updates Everything, (Mon, Sep 14th)
blogs_sans_isc·2026-09-14·CVSS 6.5
CVE-2022-3437 [MEDIUM] Apple Updates Everything, (Mon, Sep 14th)
Apple Updates Everything
Published: 2026-09-14. Last Updated: 2026-09-14 18:33:44 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Today, Apple released its annual update across all its operating systems. With that, Apple not only released new features but also patched 261 different vulnerabilities. This is the most vulnerabilities Apple has ever patched, but the increase is not as significant as other vendors' "post-AI" patch releases.
In addition to the major "27" version, Apple also released bug-fix-only releases for the 26 branch of its operating systems and for 15 (Sequioa) for macOS. None of the vulnerabilities is labeled as being exploited. Apple does not note a severity to individual vulnerabilities.
There are some reports about difficulties downloading iOS 27. Users instead
Hackernews
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
blogs_hackernews·2026-08-19·CVSS 9.8
CVE-2026-65400 [CRITICAL] Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, stating they are being exploited in the wild.
The shortcomings added to the KEV catalog are listed below -
CVE-2026-65400 (CVSS score: 9.8) - An improper authentication vulnerability impacting Apple macOS that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
CVE-2026-55040 (CVSS score: 9.1) - A weak authentication vulnerab
Checkpoint
17th August – Threat Intelligence Report
blogs_checkpoint·2026-08-17
CVE-2026-68820 17th August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 17th August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 17th August, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes. Officials confirmed that some files were encrypted but stated that no data theft was detected during the incident.
MyDr, Poland’s primary
Hackernews
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
blogs_hackernews·2026-08-17·CVSS 9.8
CVE-2026-59310 [CRITICAL] ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
The expensive attacks are not always the clever ones.
This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was already there and defenses that assumed nobody would look too closely.
So, nothing magical. Just a lot of small openings turning into bigger problems. Here’s what stood out.
## ⚡ Threat of the Week
Suspected China APT Behind Exploitation of New V
Hackernews
Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner
blogs_hackernews·2026-08-15·CVSS 9.8
CVE-2026-65400 [CRITICAL] Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner
A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC-NL) has warned .
The vulnerability in question is CVE-2026-65400 (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an attacker already on the network to authenticate to the built-in remote desktop feature service without valid credentials.
The updates released by Apple improve state management mechan
Hackernews
⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
blogs_hackernews·2026-08-10
CVE-2026-34348 ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call. Leaving a box exposed. Trusting the default.
That pretty much covers the mood this week. Old bugs are back, supply chains are getting stranger, and some exploit paths are so short you wonder what was supposed to stop them in the first place.
That’s only part of it. Here’s everything else that made the Monday recap.
## ⚡ Threat of the Week
Anthropic's Model Attempts to Poison Open-Source Project — A new evaluati
Huntress
From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS
blogs_huntress·2026-08-07·CVSS 8.6
CVE-2026-43760 [HIGH] From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS
Acknowledgments : Special thanks to Bryan Masters and Stuart Ashenbrenner for their contributions to this investigation and write - up.
## TL;DR :
If you're running Screen Sharing on macOS and exposing it to the public internet, then we need to talk. While it's generally frowned upon to expose remote access protocols to the world, we understand that some use cases may require it. You do you!
With the uptick in hosted bare-metal Apple devices, such as the Mac mini available for on-demand workloads, SSH and Screen Sharing are commonly enabled by default on any newly provisioned service.
Apple's security releases announced in the last week of July were followed by a flurry of activity, public disclosures of newly patched bugs, and commentary on the scale of the CVEs listed. With this come
https://support.apple.com/en-us/148170https://support.apple.com/en-us/148171https://support.apple.com/en-us/148172https://support.apple.com/en-us/149035https://support.apple.com/en-us/149042http://seclists.org/fulldisclosure/2026/Aug/36http://seclists.org/fulldisclosure/2026/Aug/37https://advisories.ncsc.nl/2026/ncsc-2026-0280.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400
2026-08-06
Published
2026-08-18
Added to CISA KEV
Exploited in the wild