Critical CVSS 9.8 Actively exploited
CVE-2026-65400
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
What this means
- Exposure
- Exploitable remotely over the network, without authentication and with no action from the victim.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline.
- Weakness
- The authentication mechanism can be bypassed, letting an attacker pose as a legitimate user.
- Likelihood
- Exploitation is not hypothetical: CISA has observed it in the wild.
What to doTop priority: CISA sets the remediation deadline at 21 August 2026. Start with the instances exposed to the internet.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.