Apple's macOS Screen Sharing Flaw Is Being Exploited in the Wild - MacRumors
Skip to Content

Apple's macOS Screen Sharing Flaw Is Being Exploited in the Wild

by

The screen sharing flaw that Apple rushed out a fix for earlier this month has already been exploited in the wild, according to the Netherlands' National Cyber Security Center (NCSC-NL).

macOS Tahoe Finder Bug Underscores Apples Slipping UI Polish Feature
On August 6, Apple released macOS Tahoe 26.6.1, an update to the ‌macOS Tahoe‌ operating system that came out last year. The update came a little over a week after Apple released macOS Tahoe 26.6.

In its security support document, Apple said that the update addressed a vulnerability that could allow an attacker to authenticate to Screen Sharing without valid credentials – in short, a bad actor could view a user's Mac screen and remotely take control of their keyboard and mouse. It appears however that hackers have already been taking advantage of the flaw.

As first reported by ArsTechnica, the NCSC-NL said that it had been notified of abuse of the vulnerability, "observed on multiple systems on which port 5900 was accessible from the internet." The reason is that when screen sharing is enabled, macOS's firewall intentionally exposes this port.

"In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed," the NCSC-NL added. In other words, a targeted Mac's resources are used to mine cryptocurrency.

When pushing the fix – which was also included in macOS Sonoma 14.8.9 and macOS Sequoia 15.7.9 – Apple said it had addressed the authentication issue with "improved state management." Users who have not updated their Macs should do so as soon as possible. Even for those who have updated, use of a VPN is also recommended when screen sharing is active.

If you're not sure if your macOS version is up-to-date, you can check by going into your Mac's System Settings and selecting General ➝ Software Update.

Popular Stories

iPhone 18 Pro Rumored Colors

What's Coming in September: New iPhones, Apple Watches and More

Thursday August 13, 2026 4:20 pm PDT by
Apple will introduce at least five new devices at its iPhone-centric event next month, and it's also possible we'll get devices waiting on Siri AI like the Apple TV. iPhone 18 Pro The iPhone 18 Pro is going to look like the iPhone 17 Pro, but with a smaller Dynamic Island. It's getting some internal updates, including a new Wide camera with a variable aperture for more control over lighting ...
Read Full Article • 25 comments
iPhone 17 One Year Later Thumb 1

Should You Buy an iPhone 17 Now or Wait for iPhone 18?

Friday August 14, 2026 12:15 pm PDT by
For the first time since Apple started selling standard and "Pro" iPhones, we're not going to get an entry-level iPhone model this fall. Apple doesn't plan to release an iPhone 18 in September, and will only launch the iPhone 18 Pro, iPhone 18 Pro Max, and foldable iPhone Ultra. The lower-cost iPhone 18 won't come out until spring 2027. Subscribe to the MacRumors YouTube channel for more ...
Read Full Article • 107 comments
Four iPhone 18 Pro Colors Mock Feature

iPhone 18 Pro: Pre-Orders and Release Date

Sunday August 16, 2026 8:24 pm PDT by
Apple has yet to reveal when the iPhone 18 Pro and iPhone Ultra will be announced and released, but the dates usually follow a familiar pattern. As usual, the event is expected to take place in the first half of September. Labor Day falls on September 7 this year. The last time the holiday was on that day was in 2020, but the iPhone event that year was delayed until October due to the...
Read Full Article

Top Rated Comments

jchap Avatar
jchap
2 hours ago at 05:35 am

personal alternative: never installing Tahoe to begin with
The fix was also required and issued for Sonoma and Sequoia; it is not particular to Tahoe.
Score: 18 Votes (Like | Disagree)
I
ignatius345
1 hour ago at 06:21 am
Of note: the default setting for Screen Sharing is OFF on macOS. So, unless you've specifically switched it on AFAIK you're not vulnerable to this particular exploit.
Score: 4 Votes (Like | Disagree)
M
MilaM
2 hours ago at 05:54 am

How vulnerable is a computer behind a cable modem, etc. with a local IP address (10.0.*.*, 192.168.*.*)?
I would like to know that too. Most internet routers should block incoming connections from the Internet by default. Unless you explicitly forward all (or selected) ports to your Mac of course. But the article above is very not clear about that.
Score: 3 Votes (Like | Disagree)
C
CarAnalogy
25 minutes ago at 07:20 am
5900 should never, ever be exposed directly to the internet anyway. At best, you’re going to be constantly flooded with brute force login attempts.

The real issue here is that authentication can be bypassed entirely.

This is also dangerous on untrusted public networks where devices are allowed to communicate with each other.

I wish macOS had better built in firewall controls. Windows has actually mitigated things like this by automatically calling networks “public” until told otherwise, denying all incoming connections.
Score: 2 Votes (Like | Disagree)
chucker23n1 Avatar
chucker23n1
37 minutes ago at 07:09 am

Does the vulnerability persist if Screen Sharing is Off?
No.


Note that Apple generally leaves every possible "daemon" or "service" running regardless of whether it is being used / turned off.
It's the opposite: they generally design their daemons such that they only run when a socket is open. That's also true of screensharingd. You can easily try this yourself:

[LIST=1]
* With Screen Sharing disabled, open Activity Monitor, and search for screensharingd. You probably won't find it.
* Now in Terminal, do telnet localhost 5900. This will fail with "connection refused", as there's nothing listening. screensharingd still won't be running, of course.
* Now turn it on. Notice that screensharingd still isn't running!
* Finally, try telnet localhost 5900 again. This time, it'll work, and the very act of connecting to that port is what actually launches the daemon.

This is a mechanism in launchd with security and energy benefits. Instead of having screensharingd constantly listening for connections, launchd does the listening:

<key>Sockets</key>
<dict>
<key>Listener</key>
<dict>
<key>Bonjour</key>
<string>rfb</string>
<key>SockServiceName</key>
<string>vnc-server</string>
</dict>
</dict>




1) Enable Firewall (which for some reason defaults to off despite all the kabuki theater of Apple security)
I don't think that would do anything useful in this scenario. If you don't want Screen Sharing to accept connections, just leave it off. If you do, you'll also need to let the firewall allow it in.


3) Ensure everything in Sharing is off as well as all options under them (belts and suspenders people belts and suspenders)
Sure, but that's the default anyway.
Score: 1 Votes (Like | Disagree)
Steve Adams Avatar
Steve Adams
52 minutes ago at 06:54 am

Which are?
Linux and Windows.....
Score: 1 Votes (Like | Disagree)
Read All Comments