Get all your news in one place.
100's of premium titles.
One app.
Start reading
Tom’s Hardware
Tom’s Hardware
Technology
Luke James

Critical macOS Screen Sharing flaw gives attackers remote root access — CISA bumps bug to 9.8 severity following active Monero cryptojacking attacks

MacOS 26 Tahoe.

The Dutch National Cyber Security Centre (NCSC-NL) reported on August 12 that attackers are actively exploiting CVE-2026-65400, an authentication bypass in macOS Screen Sharing, to compromise Macs with port 5900 exposed to the Internet. In every case reported to the agency, attackers obtained root access and installed a Monero cryptocurrency miner. Apple patched the flaw on August 6 in an out-of-band update covering macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, but the bug's official severity has since been rewritten, with CISA raising its CVSS score from 7.1 to 9.8 critical on August 14, now assessing the attack as automatable.

Go deeper with TH Premium: CPU

Sign up to read this article
Read news from 100's of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.