CVE-2026-65400: Apple macOS Improper Authentication Vulnerability

CVE-2026-65400 is an improper authentication weakness in Apple macOS that can let an attacker on the network authenticate to Screen Sharing without valid credentials. For IT and security teams, that matters because Screen Sharing is a remote-access path: successful abuse can give an unauthenticated network attacker interactive access to a Mac that has the service reachable, with impact depending on how Screen Sharing is configured and what the session can reach.

Public detail in the record is limited to the product class (macOS), the weakness type, and the Screen Sharing authentication bypass described by CISA. Confirm exact builds, fixed releases, and configuration prerequisites against Apple’s vendor advisory before you treat any host as patched or out of scope.

How it works

This issue is classified as CWE-287 (Improper Authentication). In plain terms, the authentication checks that should prove a client is allowed to use Screen Sharing do not work as intended, so a network attacker may be able to complete authentication without legitimate credentials.

Abuse, at a high level, requires network reachability to the Screen Sharing service on a vulnerable macOS system. The attacker does not need valid Screen Sharing credentials if the flaw can be triggered as described. The record does not provide exploit mechanics, payloads, or protocol-level detail; do not assume remote code execution, privilege escalation beyond what Screen Sharing already grants, or wormable behavior unless the vendor advisory states them. Treat the realistic outcome as unauthorized remote desktop-style access via Screen Sharing when the service is exposed to the attacker’s network path.

Am I affected? How to find it in your systems

Apple macOS is the affected product. Screen Sharing (and related remote-management setups that rely on it) commonly appears on developer workstations, admin Macs, lab machines, and any host where remote GUI access was enabled for support. It may be on by default in some managed images or turned on via System Settings / remote management profiles.

• Inventory: Enumerate macOS endpoints in MDM (Jamf, Kandji, Intune, etc.), Apple Business Manager, directory/device records, and network asset DBs. Flag hosts with Screen Sharing, Remote Management, or ARD-related services enabled.
• Version and config check: Compare each Mac’s macOS version and security update level to the fixed releases named in Apple’s advisory for CVE-2026-65400. Confirm whether Screen Sharing or remote management is enabled and from which interfaces (local LAN only vs. wider networks).
• Exposure: Identify Macs with Screen Sharing ports or related services reachable from untrusted networks (internet, guest Wi-Fi, flat corporate segments). Stakeholders should evaluate internet exposure per CISA’s BOD 26-04-oriented guidance referenced in the record.
• Telemetry / exploitation signs: Review logs for unexpected Screen Sharing or remote-management session starts, authentications that do not match known admin accounts or jump-host patterns, connections from unusual source IPs, and sudden interactive sessions on servers or kiosks that should not be remoted. Correlate with VPN, firewall, and EDR process/network events around the Screen Sharing stack. The record does not define unique IoCs; use baseline deviation and vendor guidance.

How to remediate

Patch first. Apply the macOS security updates Apple designates for this vulnerability, following vendor instructions and your normal macOS update ring (test, pilot, broad deploy). CISA’s required action is to apply mitigations in accordance with vendor instructions, align with BOD 26-04 prioritization of security updates based on risk, and follow CISA’s forensics triage requirements as applicable. For cloud-adjacent or managed service contexts, follow applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the affected product capability as directed in that framework.

• Verify post-update OS build numbers against the advisory on a sample of devices via MDM compliance reporting.
• Re-validate that Screen Sharing remains necessary; disable it where remote GUI access is not required.
• Enforce least privilege on accounts that may use remote access, strong local and directory authentication policies, and separate admin identities from daily drivers.
• Document residual risk for any Mac that cannot take the update immediately and track them under exception process with compensating controls (next section).

If you can't patch immediately

Reduce reachability and watch closely until the vendor update is installed.

• Segmentation: Block Screen Sharing and related remote-management ports/protocols from untrusted networks at the host firewall and network edge. Allow only from dedicated admin subnets or jump hosts.
• Disable the feature: Turn off Screen Sharing / Remote Management on internet-facing or high-risk Macs until patched.
• Access control: Require VPN or zero-trust brokers for any remaining remote support path; avoid direct exposure of Screen Sharing to the internet.
• Virtual patching / filtering: Where a network control can restrict or inspect the Screen Sharing path, apply strict allowlists. Do not rely on generic WAF rules alone for a desktop remote-access service; prefer deny-by-default network policy.
• Monitoring: Heighten alerting on new Screen Sharing listeners, unexpected session establishment, and lateral movement from Mac subnets. Preserve logs consistent with CISA forensics triage expectations if compromise is suspected.

Known ransomware use is not documented for this CVE in the provided record; still treat unauthorized Screen Sharing access as a serious incident path.

If your data may have been exposed

Actively exploited remote-access flaws often precede broader compromise, data access, or persistence. If Screen Sharing may have been reachable on vulnerable macOS hosts, investigate session history, endpoint forensics, and credential use; rotate credentials that could have been used or observed in remote sessions; and follow your incident response and CISA triage guidance. You can also run a free exposure scan of your email addresses against known breach datasets to see whether those identities already appear in public breach collections, which helps prioritize further monitoring and password resets.