A serious Mac screen sharing vulnerability is being actively exploited

Apple recently issued updates for three versions of macOS, addressing a critical screen sharing vulnerability in macOS Tahoe, Sequoia, and Sonoma. While there was no initial evidence of the security flaw being exploited, recent reports indicate otherwise. Apple released macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1, with initial release notes stating only that they provided "important security fixes" recommended for all users. Later, the company clarified the impact.

A flaw in the authentication process was addressed, with improved state management ensuring enhanced security. Screen sharing, while convenient, is a significant security risk as it allows attackers to access your screen, open applications and files, and perform various actions as if they physically possessed your machine. Apple initially claimed there was no evidence of the vulnerability being exploited, but this is no longer the case.

The Netherlands National Cyber Security Center reported that attackers have actively exploited the vulnerability on multiple systems with port 5900 accessible from the Internet. In these cases, attackers gained root access and installed a Monero crypto miner. The potential for attackers to steal credentials and further compromise systems is a significant concern. If you are running any of the affected macOS versions and have not yet updated, doing so immediately is crucial.

To mitigate potential risks, it is best practice to only enable screen sharing when actively using the feature. Screen sharing can be enabled or disabled in System Settings > General > Sharing, and it should be turned off immediately after your session ends. For more Apple news, check out 9to5Mac on YouTube.