No Password Needed: macOS Screen Sharing Flaw (CVE-2026-65400) Used to Deploy Monero Miners
Summary
Apple has addressed an authentication vulnerability in the macOS Screen Sharing component, tracked as CVE-2026-65400, that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. The flaw was reported by security researcher Alfredo Pesoli of Bynario, and Apple's advisory was published on August 6, 2026.
The vulnerability has been observed under active exploitation. The Netherlands' National Cyber Security Centre (NCSC-NL), through advisory NCSC-2026-0280, reported exploitation against multiple macOS systems where TCP port 5900 was reachable from the internet. In the incidents examined by NCSC-NL, attackers obtained root access on the affected Macs and used that access to plant a Monero (XMR) cryptocurrency miner — a form of malware that quietly turns a compromised machine's processing power into a revenue stream for the attacker rather than stealing data outright.
NCSC-NL has not disclosed when the observed intrusions began, how many systems were affected, or whether the flaw was exploited as a zero-day before Apple's fix became available. It also remains unclear whether cryptocurrency mining was the only objective, since root-level access of this kind would have allowed an attacker to pursue other outcomes — such as data theft or the deployment of additional malware — had they chosen to.
Apple addressed CVE-2026-65400 through improved state management and released security updates for affected macOS branches, including macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.
Background of Monero Miner
Monero (XMR) is an open-source cryptocurrency launched in April 2014 as a fork of Bytecoin, built on the CryptoNote protocol. Unlike Bitcoin, where transaction amounts and wallet addresses are publicly visible on the blockchain, Monero was designed from the ground up for privacy: it uses ring signatures to obscure which of several possible senders authorized a transaction, stealth addresses so a recipient's real wallet address is never exposed on-chain, and Ring Confidential Transactions (RingCT) to hide the amount transferred.
Monero is "mined" using a proof-of-work algorithm called RandomX, which was specifically engineered to run efficiently on ordinary CPUs and to resist the specialized ASIC hardware that dominates Bitcoin mining. In legitimate use, this was meant to keep mining decentralized and accessible to everyday users. In practice, it also means that any general-purpose computer — a laptop, a desktop, a cloud server, or in this case a compromised Mac — can generate real, spendable value for whoever controls it, with no additional hardware required. This CPU-oriented design also makes compromised general-purpose systems suitable for unauthorized Monero mining.
The exploitation chain observed against CVE-2026-65400 follows this exact pattern. NCSC-NL found that on affected systems where Screen Sharing's TCP port 5900 was reachable from the internet, attackers used the authentication bypass to gain entry, escalated to root, and planted a Monero miner.
Vulnerability Details
| CVE ID | CVSS Score | EPSS Score | Affected Products | Vulnerability Type |
|---|---|---|---|---|
| CVE-2026-65400 | 9.8 (Critical) |
0.50% | macOS Tahoe < 26.6.1 macOS Sequoia < 15.7.9 macOS Sonoma < 14.8.9 |
Improper Authentication / Authentication Bypass |
CVE-2026-65400 is categorized under CWE-287: Improper Authentication. The vulnerability affects the Screen Sharing component and may allow a network-based attacker to authenticate without possessing valid credentials.
Apple released patched versions for the affected macOS branches. Organizations should upgrade to macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, or macOS Sonoma 14.8.9, or later supported releases.
Attack Methodology
Based on publicly confirmed incident information, exploitation associated with CVE-2026-65400 can be represented through the following high-confidence attack sequence.
Following compromise, attackers installed a Monero (XMR) cryptocurrency miner on affected systems. Cryptocurrency-mining malware consumes compromised computing resources for the attacker's financial benefit, effectively conscripting the victim's Mac into an unauthorized mining operation without the owner's knowledge or consent.
The deployment of cryptocurrency-mining software hijacks the processing resources of compromised Macs. This observed behavior aligns with MITRE ATT&CK T1496 — Resource Hijacking.
The immediate, visible cost to a victim organization is usually degraded performance: sustained high CPU usage, increased fan noise and heat, higher electricity draw, and slower response times for legitimate workloads running on the same machine. But the more significant risk is what the miner represents rather than what it does — its presence is direct evidence that an attacker achieved root-level, unauthorized remote access to the system. A cryptojacking payload is often what a financially opportunistic attacker deploys first and fastest after gaining access, precisely because it monetizes a compromise immediately without requiring further effort; it does not rule out that the same access could later be resold, reused, or repurposed for a more damaging follow-on attack.
Indicators of Compromise (IOCs)
| Type | Indicator |
|---|---|
| Exposed Service / Port | TCP/5900 — macOS Screen Sharing / VNC reachable from the internet |
| Associated Process | screensharingd |
| Observed Malware | XMRig 6.26.0 Monero cryptocurrency miner |
| Malware Path | .config/sysmond |
| Masquerading Name | com.apple.airportd |
| Persistence | KeepAlive LaunchDaemon associated with the cryptocurrency miner: Unauthorized SSH public key added following exploitation |
| Behavioral Indicator |
Unexpected sustained CPU utilization consistent with cryptocurrency-mining activity; Unexpected root-owned processes following unauthorized remote access; New or unrecognized launchd daemons, cron jobs, or login items created without administrator action.
|
MITRE ATT&CK Mapping
The following MITRE ATT&CK mappings represent an analyst assessment based on publicly reported attack behavior.
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1496 | Resource Hijacking | Impact |
T1190 — Exploit Public-Facing Application represents the use of an externally reachable vulnerable service to gain unauthorized initial access.
T1496 — Resource Hijacking aligns directly with NCSC-NL's observation that compromised Macs were used to run Monero cryptocurrency-mining software, consuming compute resources that the attacker never paid for in order to generate cryptocurrency the victim organization never authorized.
Visual Attack Flow
Mitigation
- Patch affected macOS systems immediately. Upgrade vulnerable systems to macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, or macOS Sonoma 14.8.9, or a later supported release.
- Disable Screen Sharing when it is not required. Removing unnecessary remote-access services reduces the network-accessible attack surface. If immediate patching isn't possible, Screen Sharing can be turned off from System Settings under General > Sharing.
- Do not expose TCP port 5900 directly to the internet. NCSC-NL observed exploitation on systems where TCP port 5900 was internet-accessible. Restrict access using appropriate firewall and network access-control policies.
- Restrict remote administration to trusted access paths. Where remote administration is operationally required, limit access to authorized systems and trusted networks, such as through a VPN or SSH tunnel rather than direct internet exposure.
- Identify previously exposed vulnerable systems. Review firewall configurations, cloud controls, external attack-surface inventories, and internal asset inventories for Macs that exposed Screen Sharing while running vulnerable macOS versions.
- Investigate exposed systems for compromise. Patching prevents future exploitation but does not remove activity that may already have occurred. Previously exposed hosts should be reviewed for unauthorized Screen Sharing activity, suspicious root-owned processes, unfamiliar binaries, and unusual outbound connections.
- Monitor for cryptocurrency-mining behavior. Investigate unexplained sustained CPU utilization, unfamiliar long-running processes, unexpected root-level execution, unrecognized persistence mechanisms (launchd daemons, cron jobs), and network connections associated with cryptocurrency mining-pool infrastructure.
- Treat a miner as a sign of deeper compromise, not just a nuisance. Because the miner is evidence of root-level unauthorized access, remediation should include a broader compromise assessment rather than simply removing the mining process and considering the incident closed.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
