Source: Ars Technica
Introduction
A critical security flaw affecting Apple’s desktop operating system has moved from a theoretical concern to a live threat. Security agencies are now reporting that a vulnerability giving attackers full control of Macs is under active exploitation in the wild.
The situation has prompted urgent warnings for users to secure their devices against unauthorized remote access. Because the exploit targets a fundamental feature of the macOS ecosystem, administrators and individual users are being urged to verify their system settings immediately to prevent potential compromise.
What Happened
The Netherlands National Cyber Security Centrum (NCSC) recently issued a formal advisory alerting the public to malicious activity targeting macOS devices. Investigators observed that threat actors are successfully compromising systems that have port 5900 exposed to the public internet.
Once a machine is compromised via this entry point, attackers gain elevated root-level access to the operating system. In the confirmed incidents documented by the NCSC, the intruders utilized this high-level access to install unauthorized Monero cryptocurrency mining software on the victim's hardware.
Background
The vulnerability, officially designated as CVE-2026-65400, is rooted in a flaw within the macOS screen sharing architecture. This feature is designed to allow remote users to view a desktop, manipulate the cursor, and operate the keyboard, effectively providing total control over the host machine.
The root cause of the exploit is a breakdown in "state management" within the software. This component is responsible for tracking user interactions, system variables, and event sequences. When this management fails, it creates a pathway for remote parties to bypass authentication or security protocols, granting them unauthorized command over the computer.
Timeline
| Event Description | Timeframe |
|---|---|
| Apple releases security patches for affected macOS versions | Last week |
| NCSC issues public advisory regarding active exploitation | Earlier this week |
Key Details
The vulnerability carries a severity rating of 7.1 out of 10, reflecting the significant risk it poses to data integrity and system stability. Apple addressed the flaw by releasing patches for three specific iterations of its operating system.
The affected software versions include:
- macOS Tahoe
- macOS Sequoia
- macOS Sonoma
The primary vector for these attacks is the exposure of port 5900, which is the standard port for Virtual Network Computing (VNC) and Apple’s screen sharing services. By targeting devices where this port is left open to the open web, attackers can identify and infiltrate vulnerable systems.
Impact
The implications of this vulnerability are extensive for any user who leaves screen sharing enabled. An attacker who gains root access can potentially view sensitive files, install additional persistent malware, or manipulate any application running on the system.
Furthermore, the installation of crypto-mining software indicates that attackers are leveraging compromised Mac resources for financial gain. Beyond the unauthorized use of processing power, the presence of such software signals that the security perimeter of the affected machine has been completely breached.
What Happens Next
Apple has already provided the necessary security updates to mitigate the risk associated with CVE-2026-65400. Users are advised to apply these software patches immediately to ensure their systems are no longer susceptible to this specific method of exploitation.
Beyond patching, security experts recommend that users check their system configurations to ensure that screen sharing services are not unnecessarily exposed to the internet. Restricting access to port 5900 or disabling the feature entirely when not in use serves as a critical defense against ongoing malicious activity.
