Mac Screen Sharing Vulnerability Actively Exploited, Dutch Officials Warn

The vulnerability stems from a bug in the macOS screen sharing capability, which, when enabled, opens port 5900. This feature allows a remote party to view the screen and control the keyboard and mouse. The underlying cause is a flaw in the system's "state management." Apple released a patch for this vulnerability last week, addressing macOS Tahoe, Sequoia, and Sonoma. The severity rating for CVE-2026-65400 is 7.1 out of 10.

Details of the exploit became public at the Black Hat security conference. While Apple stated the vulnerability "may" allow an attacker without credentials to gain access, security practitioners generally recommend keeping port 5900 closed even when screen sharing is in use, suggesting alternatives like VPNs or SSH tunneling. The safest practice involves blocking screen sharing by default, enabling it only when necessary, and disabling it after use. Installing the latest security updates is also crucial.