Vulnerability giving attackers full control of Macs is under active exploitation

Dutch security officials didn't mince words. The Netherlands National Cyber Security Centrum confirmed active exploitation of a macOS vulnerability that hands attackers full root control. The vector: screen sharing. The tell: port 5900 reachable from the internet. The payload: Monero miners dropped on compromised machines. This isn't theoretical. It's happening.

Apple patched CVE-2026-65400 last week for Tahoe, Sequoia, and Sonoma. The severity sits at 7.1 out of 10. That number undersells the reality. A state management bug in the screen sharing subsystem lets an unauthenticated remote party seize keyboard, mouse, and display. The flaw became public at Black Hat. Exploit video followed. The window between disclosure and widespread abuse just collapsed.

Apple's advisory said the bug "may" allow credential-less access. That hedge is maddening. The NCSC observed root access on multiple systems. The "may" is doing heavy lifting for Apple's liability posture, not for accuracy. Tech vendors routinely soften vulnerability language. This time the hedging clashes with observed reality. Attackers don't read advisories for nuance. They scan for port 5900 and run the exploit.

Screen sharing runs enabled by default on too many Macs. Users toggle it on for a support session and forget. Port 5900 sits open behind NAT traversal, VPN misconfigurations, or outright exposure. The NCSC warning explicitly calls out internet-accessible port 5900 as the common denominator. Every Mac with that port reachable is a target. The patch fixes the state machine. It doesn't close the port. Administrators must still audit exposure.

The miners are noise. They announce their presence — fans spin, CPU pegs, electricity bills climb. That's clumsy. A competent operator would deploy a persistent implant, harvest credentials, pivot laterally, and stay quiet. The Monero payload suggests either opportunistic spray-and-pray or a distraction. Either way, the underlying access is the story. Root on a Mac means keychain access, Safari cookies, SSH keys, iCloud tokens, and the entire user profile. The miner is a receipt. The compromise is the debt.

Enterprises running Mac fleets have a narrow window. Jamf, Kandji, Mosyle — whatever the MDM — should have pushed the patch by now. But patching doesn't undo prior access. Incident response teams need to hunt for indicators: unexpected launch agents, modified sudoers timestamps, unusual outbound connections from `screensharingd` or its children. The exploit leaves traces. They're just not the ones most EDR rules catch.

Apple's screen sharing architecture deserves scrutiny. The feature bridges convenience and catastrophe. Remote control without credential re-verification is a design choice, not an accident. The state machine bug is the proximate cause. The architecture is the root cause. Apple should harden the default posture: require explicit local consent for each incoming session, bind to localhost unless explicitly widened, and authenticate the controller against the logged-in user. Convenience fossils in the codebase become exploit primitives.

Researchers at Black Hat demonstrated the exploit cleanly. The video shows a clean transition from unauthenticated connection to root shell. No user interaction. No password prompt. The state machine loses track of who authorized what. The controller becomes the owner. That's a catastrophic trust inversion. The patch repairs the state tracking. It doesn't re-architect the trust model. The next state machine bug — and there will be one — will yield the same result.

Users who can't patch immediately — legacy hardware, managed environments with change freezes — should disable Screen Sharing in System Settings > General > Sharing. Kill port 5900 at the host firewall. Block it at the network perimeter. Treat the service as hostile until the patch lands and validates. The NCSC warning is a gift. It tells you exactly where to look and what to fear.

The industry will move on. Next week brings a new CVE, a new patch cycle, a new advisory hedged with "may." But this one matters. It's remote, unauthenticated, root, and actively weaponized. The Mac threat model has shifted. The "Macs don't get viruses" complacency died years ago. This exploit buries it. Attackers now have a reliable, low-complexity path to macOS root. They'll use it. They are using it. The only question is whether your port 5900 is still listening.