Apple macOS Improper Authentication Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-65400.

What it is

CVE-2026-65400 is an improper authentication flaw in macOS Screen Sharing. The vulnerability allows an attacker on the network to authenticate to Screen Sharing without supplying valid credentials.

The CVSS vector shows this is reachable over the network with low attack complexity and no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N). This points to a flaw in Screen Sharing’s authentication handling itself rather than a client-side issue needing user action. Successful exploitation gives high impact to confidentiality, integrity and availability, consistent with an attacker gaining an authenticated session on the target Mac.

The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-18. This means it is known to be exploited.

Affected macOS versions are not stated here; consult Apple’s advisory for the specific releases in scope. No fixed releases are listed at this point — check Apple’s advisory directly for update availability.

What to do

  • Check Apple’s advisory at the CVE-2026-65400 page for the specific macOS versions affected and for any update once published.
  • Until a fix is confirmed, disable Screen Sharing on any Mac where it is not strictly required, particularly on machines reachable from untrusted networks.
  • Where Screen Sharing must remain enabled, restrict access at the network level — firewall rules or VPN-only access — so it is not reachable from the open network.
  • Given this is listed in CISA KEV, treat patching as urgent once Apple issues a fix, and prioritise identifying all Macs with Screen Sharing enabled in your estate now rather than waiting for the patch.
  • Review Screen Sharing logs and remote access history on exposed machines for signs of unexpected sessions.

For leadership 🧭

Executive summary. Risk is Critical (CVSS 9.8) across any Apple kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source