Active Exploitation of macOS Vulnerability CVE-2026-65400

• •CVE-2026-65400 is actively exploited, allowing remote code execution on macOS.
• •Systems with port 5900 exposed are particularly vulnerable to this attack.
• •A patch was released by Apple last week, but exploitation is confirmed in the wild.

A high-severity macOS vulnerability, tracked as CVE-2026-65400, is currently under active exploitation, allowing attackers to execute malicious code. The Netherlands National Cyber Security Centrum reported that systems with port 5900 exposed to the Internet have been compromised, with root access gained and Monero crypto miners installed. The vulnerability, which affects macOS Tahoe, Sequoia, and Sonoma, has a CVSS score of 7.1, indicating a high severity level. It is caused by a flaw in the screen sharing capability's state management. Apple issued a patch for this vulnerability last week, but the exploit was publicly detailed at the Black Hat security conference. Apple has stated that the vulnerability may allow unauthorized access without credentials, though the exact nature of the exploitation remains unclear. Security firm Bynario is credited with reporting the vulnerability.