macOS flaw grants attackers remote root access and fuels cryptojacking

The digital landscape is constantly evolving, but sometimes, a single vulnerability can lead to catastrophic outcomes. Recently, security experts highlighted a critical flaw in macOS that allowed attackers to bypass authentication and gain deep control over vulnerable computers exposed to the internet.

The issue revolves around CVE-2026-65400, an authentication bypass vulnerability residing within macOS Screen Sharing functionality. This feature, which allows remote desktop access via VNC on TCP port 5900, is designed to be disabled by default, but if left exposed, it presents a significant security risk.

The danger wasn’t theoretical; reports revealed that malicious actors were actively exploiting this flaw to compromise Macs accessible from the internet. In multiple incidents reported to the Dutch National Cyber Security Centre (NCSC-NL), attackers successfully achieved root access on these systems. Once control was established, the exploit provided a perfect pathway for installing cryptocurrency miners, turning these devices into unwitting participants in illicit mining operations.

The speed with which this vulnerability became weaponized underscored its severity. Although Apple swiftly responded by releasing an out-of-band update to patch the bug on August 6th across macOS Tahoe, Sequoia, and Sonoma operating systems, security agencies quickly revised their assessment of the threat level.

Initially, the severity was rated at a CVSS score of 7.1. However, subsequent analysis by the Cybersecurity and Infrastructure Security Agency (CISA) indicated a much broader implication. On August 14th, CISA dramatically raised this rating to 9.8 critical, recognizing that the attack vector could now be automatable.

This shift in assessment reflected the real-world threat: unattended Macs being compromised at scale for resource exploitation. The vulnerability moved from a theoretical bug to an actively exploitable mechanism used by sophisticated attackers seeking full control over networked devices.

The incident served as a potent reminder that even seemingly benign features, like remote desktop protocols, require meticulous security oversight. While the immediate threat was mitigated by Apple’s patching efforts, it highlighted the ongoing necessity for organizations to maintain strict security policies regarding internet exposure and default settings.