{
  "id": 952361,
  "title": "macOS Screen Sharing CVE-2026-65400: Authentication Bypass Leads to Root Access and Monero Miner Installation",
  "url": "https://urgent.news/2026/08/15/macos-screen-sharing-cve-2026-65400-authentication-bypass-leads-to",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-15T04:23:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/anoymask/macos-screen-sharing-cve-2026-65400-authentication-bypass-leads-to-root-access-and-monero-miner-37kh"
  },
  "original_language": "en",
  "account": "An authentication vulnerability in macOS Screen Sharing, CVE-2026-65400, has been exploited by hackers to gain root access and install a Monero cryptocurrency miner. This flaw allows attackers to connect to the Screen Sharing service from the internet and authenticate without valid credentials. Once authenticated, they can launch applications, access files, and modify security settings. In some cases, attackers have managed to obtain root access. To mitigate this risk, it is recommended to update macOS to the latest versions (Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9, or later), disable Screen Sharing if not needed, block TCP/5900 from the internet, and monitor for suspicious activities like root processes and Monero miner installations.",
  "summary": "macOS Screen Sharing CVE-2026-65400: Authentication Bypass Leads to Root Access and Monero Miner Installation 1. Basic Information Severity: Critical Title: Hackers exploit macOS Screen Sharing flaw to deploy Monero miner Source: BleepingComputer Published Date: 2026-08-14 Updated Date: N/A Original Article: Original Article Related Sources: Apple Security , NCSC-NL NCSC-2026-0280 Malware: Monero…",
  "key_points": [
    "Authentication bypass vulnerability in macOS Screen Sharing exploited",
    "Hackers gain root access and install Monero miner",
    "Update macOS, disable Screen Sharing to mitigate risk"
  ],
  "editors_take": "Exploiting this macOS Screen Sharing vulnerability allows attackers to bypass authentication and gain root access, enabling them to install malware like Monero miners, highlighting the need for immediate software updates and network security adjustments.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}