MacOS Screen Sharing bug skips the password check

Published August 7, 2026 CVE-2026-65400

Apple's Screen Sharing feature on Mac had a bug that let anyone on the network log in without any username or password, then read or write files with the system's highest privileges. Researchers showed this can extend to running the attacker's own commands on the Mac.

Severity
CriticalCVSS 3.1 · 9.8
Fix
Fixed in 14.8.9Fix recorded on Aug 26, 2026
Affected versions
before 14.8.9; before 15.7.9; before 26.6.1
Weakness
CWE-287Improper Authentication
Exploit likelihood
9.9% in 30 daysEPSS, higher than 95% of known flaws
Affects
macOS
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 18, 2026
Federal fix deadline
Aug 21, 2026

How it works

A flaw in how Screen Sharing's login process checks the length of connection data lets it fall into a leftover success state, so the service marks a connection as authenticated even though no valid account or password was ever supplied.

What to do

Check whether Screen Sharing is turned on under System Settings, General, Sharing, and compare your macOS version and build against Sonoma 14.8.9, Sequoia 15.7.9, or Tahoe 26.6.1. Removing approved users or disabling the old VNC password will not protect you, since the bug is triggered before login happens.

Update through Software Update to macOS Sonoma 14.8.9, Sequoia 15.7.9, or Tahoe 26.6.1 right away, and if you cannot patch immediately, turn off Screen Sharing and block remote access at your network firewall instead.

Technical details

Affected software: macOSby Apple

Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source