A recently patched security flaw in Apple macOS has been exploited to deploy a cryptocurrency miner, according to the Netherlands National Cyber Security Centre (NCSC) This article explores security flaw apple. . The vulnerability, identified as CVE-2026-65400 (CVSS score: 9.8), is a critical authentication issue affecting the Screen Sharing component and allows an attacker already on the network to authenticate to the built-in remote desktop feature service without valid credentials.
Apple has introduced updates that enhance state management to ensure proper credential validation and prevent unauthorized authentication attempts. The company also acknowledged that these issues were part of a series of problems that had been fixed by Apple with their latest update to macOS - CVE-2026-43779 (CVSS score: 9.8) and CVE-2026-43777 (CVSS score: 7.5).
Pesoli described this as a post-authentication bug in the Screen Sharing component, noting that it required users with Screen Sharing or Remote Management enabled and VNC viewers configured with "VNC viewers may control screen with password" enabled to have their Macs compromised. The problem involved a legacy authentication path involving VNC password access, which turned file copy operations into protected file disclosure, arbitrary root file creation, and remote root command execution. When dealing with oversized frames, this causes the program to prematurely bail out and hand back a value that corresponds to the success code from the read operation just before it.
