CVE-2026-65400
About
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
Rainforest analyst review
An authentication flaw in Apple's Screen Sharing, fixed through improved state management, lets an attacker on the same network authenticate to the service without valid credentials. The defect is in how the authentication state is tracked during the connection, so an attacker who can reach an affected Mac's Screen Sharing service can gain a remote session as if they had legitimately logged in — no password required, only network adjacency.
The exposure is bounded by network reachability rather than internet-wide scanning: Screen Sharing is typically enabled on machines meant to be administered remotely across a LAN or VPN, so the risk concentrates in shared offices, labs, and any environment where an untrusted party can sit on the same network segment. A successful login yields interactive control of the desktop and whatever the logged-in user can do. Install the fixed macOS versions — Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1 — across the fleet, and in the meantime disable Screen Sharing where it is not needed and restrict it to trusted management networks so an attacker cannot reach the service in the first place.
References
- https://support.apple.com/en-us/148170
- https://support.apple.com/en-us/148171
- https://support.apple.com/en-us/148172
- http://seclists.org/fulldisclosure/2026/Aug/36
- http://seclists.org/fulldisclosure/2026/Aug/37
- https://advisories.ncsc.nl/2026/ncsc-2026-0280.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400
Related CVEs
Frequently asked questions
What is CVE-2026-65400?
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
How severe is CVE-2026-65400?
CVE-2026-65400 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2026-65400 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2026-65400?
Public advisories list the following as affected: macos. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2026-65400?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.