Dutch NCSC Flags CVE‑2026‑65400 Screen‑Sharing Flaw Exploited on macOS

Apple’s macOS is often praised for its polished user experience, yet a newly disclosed Screen Sharing vulnerability is turning that reputation on its head. The Dutch National Cyber Security Centre (NCSC) has confirmed that CVE‑2026‑65400 is being leveraged in the wild, allowing threat actors to gain full control of vulnerable machines and install cryptominers without user interaction.

What’s Happening: An Active Exploit Landscape

The NCSC’s advisory warns that the flaw is not merely theoretical; active abuse has been observed across multiple sectors. Attackers exploit the vulnerability to bypass authentication, log in remotely, and execute arbitrary code with root privileges. The immediate payoff for adversaries is the rapid deployment of cryptocurrency mining payloads, which can silently drain resources and expose the host to further compromise.

Technical Anatomy of the Screen Sharing Flaw

Screen Sharing on macOS relies on a combination of VNC‑style protocols and Apple’s own authentication mechanisms. CVE‑2026‑65400 stems from an authentication bypass that occurs when the service processes specially crafted connection requests. By manipulating the handshake, an attacker can convince the daemon that the request originates from a trusted source, effectively sidestepping password verification.

Once past the gate, the malicious payload runs with the same privileges as the Screen Sharing service—root on most configurations. This privileged execution path enables the attacker to install kernel extensions, modify system files, and hide their activity from standard user‑level monitoring tools.

Why the Vulnerability Is Hard to Spot

• Silent Remote Access: The exploit does not require any user interaction after the initial connection, making it invisible to most users.
• Root Persistence: By leveraging the system’s launch agents, attackers can ensure their code survives reboots.
• Low Signature Footprint: Cryptominer binaries are often obfuscated, evading traditional antivirus heuristics.

Active Exploitation and Real‑World Impact

Security researchers have observed the exploit being used to plant cryptomining software on both enterprise and personal Macs. The miners typically target coins that can be mined efficiently on consumer hardware, turning infected devices into profit‑generating bots. In addition to the obvious performance degradation, the hidden activity expands the attack surface, allowing secondary payloads—such as ransomware or data exfiltration tools—to be introduced later.

"We have seen multiple instances where the Screen Sharing bug was the initial foothold, followed by the rapid deployment of cryptocurrency miners," the NCSC warned in its public statement.

Because the vulnerability affects the core remote‑desktop functionality, any Mac with Screen Sharing enabled—whether for legitimate remote work or personal convenience—is potentially at risk. Organizations that expose macOS devices to the internet without additional hardening measures are especially vulnerable.

Detection, Mitigation, and GetKhojo’s Role

Apple released a patch shortly after the vulnerability was disclosed, and the update is available through the standard Software Update mechanism. Applying the patch is the single most effective mitigation step. However, many users delay updates, and some legacy devices may no longer receive patches.

For security teams, the challenge is twofold: identifying compromised hosts and preventing future abuse. Here’s where GetKhojo’s platform adds value:

• External Attack‑Surface Scanning: Our scanners probe public IP ranges for open Screen Sharing ports (5900/tcp) and flag machines that expose the service without proper VPN or firewall protection.
• Vulnerability Verification: GetKhojo can perform credential‑less checks to confirm whether a host is vulnerable to CVE‑2026‑65400, allowing rapid triage before a full remediation cycle.
• Privacy‑First Monitoring: All scans are conducted without storing personal data, aligning with privacy‑by‑design principles while still delivering actionable intelligence.

In addition to external scanning, internal defenders should leverage endpoint detection and response (EDR) tools to hunt for anomalous process activity associated with cryptominers—high CPU usage, unknown launch agents, or suspicious network connections to known mining pools.

Future Outlook and Hardening Recommendations

While Apple’s patch addresses the immediate flaw, the broader lesson is the importance of a layered defense strategy for macOS environments. Below are practical steps organizations and individuals can adopt:

• Disable Unused Services: If Screen Sharing is not required, turn it off in System Settings or enforce its restriction via mobile device management (MDM) policies.
• Enforce Network Segmentation: Keep remote‑desktop services behind VPNs or zero‑trust gateways to limit exposure to the public internet.
• Patch Management Discipline: Automate macOS updates where possible and verify that critical patches are deployed within 48 hours of release.
• Monitor for Privilege Escalation: Deploy tools that alert on unexpected root‑level process launches, especially from the Screen Sharing daemon.
• Educate End‑Users: Raise awareness that enabling remote access features can increase risk, and encourage regular security hygiene checks.

What This Means for You

For anyone running macOS—whether at home or in a corporate setting—the takeaway is clear: an exposed Screen Sharing service can be weaponized to hijack your machine and turn it into a silent crypto‑mining platform. Apply Apple’s latest security update immediately, verify that Screen Sharing is only accessible through trusted networks, and consider a GetKhojo external scan to confirm your exposure. Proactive privacy‑focused scanning combined with disciplined patching will keep your Mac out of the attacker’s toolbox.