CVE-2026-65400 in macOS
Summary
by MITRE • 08/07/2026
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This authentication vulnerability represents a critical flaw in Apple's macOS screen sharing implementation that could allow unauthorized network-based attackers to establish remote desktop connections without proper credentials. The issue stems from inadequate state management within the authentication framework, creating a pathway for malicious actors to bypass legitimate authentication mechanisms and gain unauthorized access to systems running affected versions of macOS.
The technical root cause involves improper handling of session states during the screen sharing authentication process, where the system fails to properly validate or maintain authentication context throughout the connection lifecycle. This weakness enables an attacker positioned on the same network segment to exploit the vulnerable service and establish screen sharing sessions without presenting valid user credentials. The vulnerability specifically affects the Screen Sharing service component that utilizes Apple's Remote Management protocols, which are commonly deployed in enterprise environments for remote system administration.
From a cybersecurity perspective, this issue creates significant operational risks as it allows attackers to perform reconnaissance activities, extract sensitive information, or maintain persistent access to compromised systems. The vulnerability aligns with CWE-287 which addresses improper authentication issues, and maps to ATT&CK technique T1075 which covers legitimate credentials for privilege escalation. Network-based attackers can leverage this flaw to conduct lateral movement within networks where macOS systems are present, particularly in environments where screen sharing services remain enabled without proper network segmentation or additional security controls.
The affected versions include macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, and macOS Tahoe 26.6.1, indicating that this vulnerability spans multiple major releases of Apple's operating system. Organizations should prioritize patching these specific versions as soon as possible to remediate the authentication gap. The fix implemented by Apple addresses the state management issues by strengthening session validation mechanisms and ensuring proper credential verification throughout the entire screen sharing authentication flow.
Security practitioners should implement additional network-level controls including firewall rules that restrict access to screen sharing ports, disable unnecessary screen sharing services on systems where they are not required, and monitor for unusual authentication patterns or unauthorized screen sharing connection attempts. The vulnerability demonstrates the importance of maintaining up-to-date security patches and implementing defense-in-depth strategies that reduce the attack surface of remote management services. Organizations should conduct immediate assessments of their macOS deployments to identify systems running vulnerable versions and ensure proper patch management procedures are in place to prevent exploitation of similar authentication flaws in other network services.