[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVP095ARQKUIOyIWaSrxcZOlraULWJtgOTMew_yYo52g":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"d4a2d3ea-d3c5-439e-aaa2-ee4564a89527","Recent macOS Screen Sharing Vulnerability Exploited in Attacks","recent-macos-screen-sharing-vulnerability-exploited-in-attacks-cb007e","Threat actors gained root access to the vulnerable systems and deployed a Monero miner. The post Recent macOS Screen Sharing Vulnerability Exploited in Attacks appeared first on SecurityWeek.","Threat actors are actively exploiting a recently patched macOS Screen Sharing vulnerability, CVE-2026-65400, to gain root access and deploy Monero cryptominers. The flaw allows remote attackers to bypass authentication and log in without valid credentials. Apple released fixes in late August, but exploitation began shortly after, fueled by a public proof-of-concept exploit.","macOS Screen Sharing vulnerability (CVE-2026-65400) exploited for root access and Monero mining.","https:\u002F\u002Fwww.securityweek.com\u002Frecent-macos-screen-sharing-vulnerability-exploited-in-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F02\u002FMacOS-Mac-malware-Apple.jpeg","2026-08-17T08:47:38+00:00","2026-08-17T10:00:19.99988+00:00",8,[17,20],{"name":18,"type":19},"macOS","product",{"name":21,"type":22},"Apple","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":49,"context":50},"cve","CVE-2026-65400","macOS Screen Sharing vulnerability exploited for root access and Monero mining.",[21,18],{"controls":53,"vendors":141},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"patch-management","Automated patch management","Known holes get closed in days, not months.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":84,"name":85,"problem":86,"products":87},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":113,"name":114,"problem":115,"products":116},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[142],{"slug":143,"name":21,"logo_path":144,"roles":145},"apple","\u002Fvendor-logos\u002Fapple.png",[146],"affected",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":163},"macos-screen-sharing-flaw-exploited-for-cryptomining-after-delayed-patching","macOS Screen Sharing Flaw Exploited for Cryptomining After Delayed Patching","CVE-2026-65400 exposes a critical authentication bypass in macOS Screen Sharing, allowing unauthenticated remote attackers to gain root-level access — one of the most severe privilege escalation scenarios possible. Apple released a patch in late August, but the rapid availability of a public proof-of-concept exploit dramatically shortened the window between disclosure and active exploitation. Organizations that failed to apply the patch promptly became easy targets for cryptominer deployment, which consumes resources, degrades performance, and signals a broader foothold risk. This incident highlights that the time between patch release and exploitation is shrinking, making reactive patching cycles dangerously inadequate. Without aggressive patch prioritization and automated deployment, even well-resourced organizations remain exposed to trivially weaponized vulnerabilities.",[152,153,154,155,156,157,158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST SC-7: Boundary Protection","NIST RA-5: Vulnerability Monitoring and Scanning","ITIL Change Management: Emergency Change Procedure","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1496: Resource Hijacking (Cryptomining)",{}]