A critical vulnerability in Apple’s macOS Screen Sharing feature, identified as CVE-2026-65400, is being actively exploited by attackers to gain root access on Macs and deploy Monero cryptocurrency mining software. The Netherlands’ national cyber agency issued a warning this week regarding the active exploitation of this flaw.
The Dutch National Cyber Security Center (NCSC) reported that the vulnerability allows network-based attackers to bypass authentication, enabling them to slip through without valid credentials. Exploitation has been observed on systems where port 5900, the default port for Screen Sharing, is exposed to the internet. In these instances, attackers successfully gained root access, the highest level of control over a machine, and installed Monero mining programs.
The bug, which has a severity rating of 7.1 out of 10, is an authentication flaw stemming from faulty state management during the login process. It allows authentication attempts that should have been rejected to be accepted. Publicly available proof-of-concept code for this vulnerability is now circulating, which lowers the barrier for potential attackers.
Monero, a privacy-focused cryptocurrency, is frequently used in cryptojacking campaigns. In such schemes, hijacked machines are used to mine cryptocurrency for the attacker, who reaps the rewards while the victim bears the costs of electricity consumption and degraded system performance. The privacy features of Monero make its transactions harder to trace compared to more transparent cryptocurrencies like Bitcoin or Ethereum.
Apple has addressed the vulnerability by releasing patches for affected macOS versions. Updates are available for macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. Users who have not yet updated their systems, particularly those with Screen Sharing accessible from the open internet, remain exposed to this threat.
The NCSC advises users to apply Apple’s updates promptly and to avoid leaving Screen Sharing accessible from the internet, as this configuration provided the initial entry point for attackers.
Why This Matters
This incident highlights the immediate security risks posed by unpatched software and exposed network services. The exploitation of the macOS Screen Sharing vulnerability (CVE-2026-65400) for Monero mining demonstrates a persistent threat to users, underscoring the importance of timely security updates and secure network configurations. While the exact number of affected systems and the total value of Monero mined remain uncertain, the active exploitation is part of a broader trend of cyber schemes leveraging compromised devices for cryptocurrency profit.
Broader Context
The exploitation of the macOS Screen Sharing vulnerability for Monero mining occurs amidst a landscape of evolving cyber threats. Recent incidents include malware found in pirated software, malicious mobile apps, and compromised Python libraries, indicating a continuous effort by malicious actors to leverage compromised devices for financial gain. The use of Monero, a privacy coin, in these campaigns is driven by its features that make transactions harder to trace compared to other cryptocurrencies.
