The Netherlands National Cyber Security Centre confirmed this week that attackers are actively exploiting a critical flaw in macOS's built-in Screen Sharing feature to gain root access to internet-facing Mac servers and install Monero cryptocurrency miners. The vulnerability, tracked as CVE-2026-65400, requires no username, password, or user account to exploit, and affects any macOS system running Apple's Screen Sharing service with port 5900 accessible from the internet.

Apple issued emergency patches on August 6, 2026, covering three macOS versions: Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Despite the available fix, exploitation was confirmed in the wild within days. CISA subsequently escalated the vulnerability's severity score from 7.1 to 9.8 (Critical) on August 14, citing evidence that the attack is fully automatable with no user interaction required.

---

How the Flaw Works

The flaw was discovered by Alfredo Pesoli (@__rev) of security firm Bynario Atlas. The vulnerability lives inside screensharingd, the system daemon that manages macOS remote desktop connections using the VNC protocol. According to Huntress Research, which published a detailed technical breakdown, the daemon's authentication component contains a broken implementation of the Secure Remote Password (SRP) protocol. A frame-length validator "erroneously returns a stale success status," allowing an attacker to skip credential verification entirely and proceed with a cleartext session carrying root-level privileges.

That root access extends to SSFileCopySender, a privileged system helper with full disk access. In practical terms, an attacker who exploits this flaw can read or write anything on the target machine.

Huntress also noted that three additional related CVEs were patched in the same update cycle: CVE-2026-43779 (CVSS 9.8, network interception), CVE-2026-43777 (CVSS 7.5, denial of service), and CVE-2026-43760 (CVSS 8.6, post-authentication privilege escalation). As The Hacker News observed, the presence of both pre-authentication and post-authentication vulnerabilities in the same source component points to broader weaknesses in that area of the codebase.

Standard hardening steps offer no protection here. As summarized by BleepingComputer, rotating the VNC password, disabling legacy VNC password authentication, or removing approved Screen Sharing accounts all have zero effect on a pre-authentication bypass. The only effective mitigations are applying the patch or disabling Screen Sharing outright.

---

Why Monero, and Why Now

Attackers are deploying a Monero cryptocurrency miner on compromised systems.

Monero (XMR) is the dominant currency in cryptojacking operations because its RandomX proof-of-work algorithm is designed for CPU hardware rather than specialized mining rigs, making ordinary servers profitable targets. Its built-in privacy features, including ring signatures and stealth addresses, also make mining proceeds difficult to trace on-chain.

The financial incentive is currently elevated. Monero is trading near $415, up roughly 20% over the past 30 days, with a market capitalization of approximately $7.1 billion (ranked 17th globally). That price level represents near multi-year highs, raising the per-CPU-hour value of stolen compute meaningfully above what it was through most of 2025.

---

Scope of Exposure

Censys internet scans identified roughly 40,000 hosts with port 5900 publicly accessible, with approximately half located in the United States. The remainder spans universities, corporate networks, and server farms worldwide. Screen Sharing is not enabled by default on consumer macOS, but it is commonly turned on by default at bare-metal Apple hosting providers, which serve as the backbone for iOS and macOS CI/CD build pipelines.

That configuration detail puts South Asian developer infrastructure at particular risk. India hosts one of the world's largest iOS developer communities, with thousands of mobile development studios and freelancers relying on hosted Mac instances through services like MacStadium, MacinCloud, and AWS EC2 Mac for Xcode build automation. These environments are frequently managed remotely, often across time zones, and may run on patch cycles that lag behind emergency disclosures by days or weeks.

African developer communities face comparable exposure. Nigeria, Kenya, South Africa, Ghana, and Egypt have each seen rapid growth in Web3 and mobile development activity, with many studios and independent developers relying on remote Mac build infrastructure. Enterprise patch compliance rates in the region can lag behind those of large North American or European organizations, and the regional developer community has been a documented target of campaigns such as the North Korean-linked DeceptiveDevelopment operation. The combination of remote management dependencies and slower patch cycles makes African-hosted build environments a meaningful part of the global exposure picture.

The exploitation window was also compressed by rapid weaponization. Security researcher Pedro Vilaça published an obfuscated proof-of-concept binary shortly after Apple's patch. Separately, security firm Calif reported building a working exploit using AI coding agents in approximately four hours, a data point that illustrates how quickly disclosed vulnerabilities can be operationalized in 2026.

---

What to Do

Any team running internet-facing Mac servers should confirm the installed macOS version against the patched releases (Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9). Hosted Mac providers should have applied these updates already; developers should verify that directly with their provider rather than assuming. Teams that cannot patch immediately should disable Screen Sharing at the system level. Security teams should also monitor for screensharingd session events showing authentication_type: SRP alongside unexpected root session usernames, as these are specific indicators of exploitation attempts. Unexplained CPU spikes on macOS build servers should be treated as a potential indicator of compromise and investigated for miner binaries such as XMRig.

The NCSC-NL advisory (NCSC-2026-0280) noted that in every confirmed case of exploitation observed by Dutch authorities, root access was obtained and a Monero miner was placed on the system. With Monero near multi-year price highs and tens of thousands of potentially vulnerable hosts still indexed online, that pattern is unlikely to slow without faster patch adoption across the global developer community.