Published on August 23, 2026 · The mitza.es team
On August 6, 2026, Apple released an emergency update to fix CVE-2026-65400, a vulnerability in macOS's screen sharing service that lets a remote attacker connect to someone else's Mac without needing a password, without a valid account, and without the user having to do anything at all to trigger it.
Why it's so serious
The Netherlands' National Cyber Security Centre (NCSC-NL) updated its report on this vulnerability on August 12, after receiving reports of active exploitation, and rated it 9.8 out of 10 on the CVSS scale — practically the maximum severity possible. Attackers who exploited it gained root access on the vulnerable systems and used it to install cryptocurrency mining applications without the device owners noticing.
Which versions are affected
- macOS Sonoma prior to version 14.8.9.
- macOS Sequoia prior to version 15.7.9.
- macOS Tahoe prior to version 26.6.1.
If you use screen sharing on any of these versions without updating, your device is exposed right now.
What to do right now
Update immediately. This isn't an optional recommendation when active exploitation has been confirmed: every day that passes with an outdated system is an open window for an attacker to get in leaving barely a trace. If you manage multiple devices in your business, now is a good time to check once and for all which ones are up to date and which aren't, rather than waiting for something to fail.
Same pattern, different systems
This kind of flaw echoes the same underlying problem we already saw with wp2shell in WordPress: a widely used component, a critical vulnerability, and a short window before mass exploitation begins. It doesn't matter whether your business runs Mac or Windows — staying up to date remains the most effective and cheapest defense. Our IT maintenance service includes this kind of check, and if you want a more complete diagnosis of your overall exposure, you can request a tailored audit.