Vulnerability giving attackers full control of Macs is under active exploitation
ars ·
Dutch cybersecurity authorities have alerted the public to an actively exploited macOS flaw that enables unauthorized users to seize complete administrative control. Tracked as CVE-2026-65400, the vulnerability stems from a defect in the operating system’s screen-sharing state management mechanism. Attackers can leverage this bug to bypass login credentials and obtain root access whenever port 5900 is left open to the internet. Apple recently mitigated the threat by deploying patches for macOS Tahoe, Sequoia, and Sonoma. Initial observations indicate that cybercriminals are currently using the exploit to silently deploy Monero cryptocurrency miners on affected machines. Security professionals strongly recommend disabling screen sharing when idle, ensuring port 5900 remains blocked externally, and utilizing encrypted connections like VPNs for remote access. Users must also apply the latest official security updates to prevent more severe threats such as credential harvesting or advanced malware infection.
ars