Attackers are exploiting a critical authentication bypass flaw (CVE-2026-65400, CVSS 9.8) in macOS Screen Sharing to gain root access and deploy cryptominers. The vulnerability affects macOS Sequoia versions 15.0 through 15.7.8, Sonoma versions 14.0 through 14.8.8, and Tahoe versions 26.0 through 26.6.0. Apple has patched the issue in macOS versions 15.7.9, 14.8.9, and 26.6.1.
A recently patched security flaw in Apple macOS is being actively exploited by hackers to bypass authentication, gain root access, and install a cryptominer, the Netherlands’ National Cyber Security Centre (NCSC) warns. The vulnerability, tracked as CVE-2026-65400, , let attackers authenticate to macOS Screen Sharing without valid login credentials. Apple fixed the issue with updates to macOS Sequoia (15.7.9), Sonoma (14.8.9), and Tahoe (26.6.1), and advised its macOS users to upgrade their systems. “An authentication … More → The post Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer appeared first on Help Net Security .