[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFV7D-OI8gJWao1VHwvb-_797EE_r4Ube5kljIExDf58":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":44,"controls":45},"398bfa12-d047-46dd-abf5-9ff799c3eb36","macos-screen-sharing-flaw-exploited-for-cryptomining-after-delayed-patching","d4a2d3ea-d3c5-439e-aaa2-ee4564a89527","macOS Screen Sharing Flaw Exploited for Cryptomining After Delayed Patching","CVE-2026-65400 exposes a critical authentication bypass in macOS Screen Sharing, allowing unauthenticated remote attackers to gain root-level access — one of the most severe privilege escalation scenarios possible. Apple released a patch in late August, but the rapid availability of a public proof-of-concept exploit dramatically shortened the window between disclosure and active exploitation. Organizations that failed to apply the patch promptly became easy targets for cryptominer deployment, which consumes resources, degrades performance, and signals a broader foothold risk. This incident highlights that the time between patch release and exploitation is shrinking, making reactive patching cycles dangerously inadequate. Without aggressive patch prioritization and automated deployment, even well-resourced organizations remain exposed to trivially weaponized vulnerabilities.","**Immediate actions:**\n- Apply Apple's August patch for CVE-2026-65400 immediately across all macOS endpoints and servers.\n- Disable macOS Screen Sharing on systems where remote access is not operationally required.\n- Block inbound Screen Sharing traffic (port 5900\u002FVNC) at the perimeter firewall for all non-authorized hosts.\n\n**Long-term improvements:**\n- Implement a risk-based emergency patching SLA (e.g., critical CVEs patched within 24–72 hours of release).\n- Maintain a continuously updated asset inventory to ensure no macOS device is overlooked during patch rollouts.\n- Enforce network segmentation to isolate macOS workstations and servers from unnecessary lateral network access.\n\n**Detection measures:**\n- Deploy endpoint detection tools to alert on unexpected privileged process execution or cryptocurrency mining activity (e.g., xmrig signatures).\n- Monitor authentication logs for anomalous or unauthenticated Screen Sharing login attempts.\n- Set up vulnerability scanning schedules to automatically flag unpatched CVEs on all managed endpoints within 24 hours of disclosure.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST SC-7: Boundary Protection","NIST RA-5: Vulnerability Monitoring and Scanning","ITIL Change Management: Emergency Change Procedure","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1496: Resource Hijacking (Cryptomining)",{},"published","2026-08-17T10:20:57.524542+00:00","2026-08-17T10:20:57.233+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.securityweek.com\u002Frecent-macos-screen-sharing-vulnerability-exploited-in-attacks\u002F","recent-macos-screen-sharing-vulnerability-exploited-in-attacks-cb007e","Recent macOS Screen Sharing Vulnerability Exploited in Attacks",[32,38],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[46,49,53],{"slug":41,"name":47,"problem":48},"Automated patch management","Known holes get closed in days, not months.",{"slug":50,"name":51,"problem":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else."]