Apple macOS up to 14.8.8/15.7.8/26.6.0 Screen Sharing improper authentication

Summaryinfo

A vulnerability was found in Apple macOS up to 14.8.8/15.7.8/26.6.0. It has been declared as critical. Affected by this issue is some unknown functionality of the component Screen Sharing. Such manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-65400. The attack can be launched remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in Apple macOS up to 14.8.8/15.7.8/26.6.0. It has been rated as critical. Affected by this issue is some unknown processing of the component Screen Sharing. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

The advisory is available at support.apple.com. This vulnerability is handled as CVE-2026-65400 since 07/22/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are unknown but an exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/18/2026).

It is declared as attacked. This issue was added on 08/18/2026 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 08/21/2026:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO

Upgrading to version 14.8.9, 15.7.9 or 26.6.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2687). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Apple macOS

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• macOS

Version

• 14.8.0
• 14.8.1
• 14.8.2
• 14.8.3
• 14.8.4
• 14.8.5
• 14.8.6
• 14.8.7
• 14.8.8
• 15.7.0
• 15.7.1
• 15.7.2
• 15.7.3
• 15.7.4
• 15.7.5
• 15.7.6
• 15.7.7
• 15.7.8
• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5
• 26.6.0

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion