Tracked as CVE-2026-65400, a high-severity macOS vulnerability allowing remote attackers to execute arbitrary code and gain root access is under active exploitation. Discovered in Apple’s screen sharing architecture, the flaw affects macOS Tahoe, Sequoia, and Sonoma systems with exposed network ports, resulting in unauthorized Monero cryptocurrency miner deployments.
The digital threat landscape shifted abruptly when security telemetry flashed red. A critical macOS flaw, assigned a severity rating of 7.1 out of 10, is actively targeted in the wild. If your machine’s network configuration leaves specific remote management vectors exposed, you aren’t just vulnerable. You’re already compromised.
The Anatomy of CVE-2026-65400 and State Management Failures
At the core of CVE-2026-65400 lies a delicate engineering failure within macOS’s screen sharing capability. This native utility permits a remote operator to view a host display and manipulate input hardware like keyboards and mice while the target machine remains powered on.
The breakdown occurs specifically in state management routines. These internal system logic handlers track preceding events, user interactions, and transient variables. When an unauthenticated or improperly validated sequence hits the screen sharing daemon, the flawed state handler miscalculates memory structures or event sequencing.
Attackers exploit this state corruption to inject and execute malicious code directly into the underlying system processes. Once executed with elevated privileges, the intrusion script immediately provisions root access, locking down the host system for illicit background tasks.
Active Exploitation via Exposed Port 5900
The vector for these active compromises is remarkably straightforward. Threat actors are scanning wide swaths of IPv4 space for open network interfaces running remote frame buffer protocols.
According to warnings issued by the Netherlands National Cyber Security Centrum (NCSC) earlier this week, active abuse has been formally observed on multiple enterprise and consumer systems where port 5900 was directly accessible from the open Internet. Port 5900 is the standard designated port for Virtual Network Computing (VNC) and Apple’s native screen sharing services.
“The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” the NCSC warned. “In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed.”
The payload of choice reveals the financial motivations of the actors involved.
Apple’s Patch Release and Mitigation Strategy
Apple responded to the threat vector by issuing security updates. The patches address the state management vulnerability across multiple recent operating system iterations, specifically targeting macOS Tahoe, macOS Sequoia, and macOS Sonoma.
However, applying a software patch is only the first layer of defense. Systems that have already experienced exploitation require extensive forensic remediation. Because the attackers successfully escalated privileges to root level, simple patch application will not remove persistence mechanisms, modified launch daemons, or the active crypto-mining binaries already residing in system directories.
Enterprise IT administrators and individual power users must audit their network perimeters immediately. Ensuring that port 5900 is blocked at the hardware firewall level, disabling remote screen sharing services when not actively required, and verifying that all client machines are updated to the latest patched macOS versions are mandatory steps to halt the current exploitation wave.
