CriticalCVE-2026-65400

    Apple macOS Improper Authentication Vulnerability (CVE-2026-65400)

    Published Last modified In CISA KEV since Sources: BSI, CVE.org, pwn.watch

    What is affected, what to do

    An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7.

    The vulnerability is being actively exploited; treat it as a priority. Update Apple macOS to version 14.8.9, Apple macOS to version 15.7.9, Apple macOS to version 26.6.1. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Apple macOS lt *..14.8.9
    • Apple macOS lt *..15.7.9
    • Apple macOS lt *..26.6.1
    • Apple macOS lt *..26.7
    • Apple macOS lt *..27
    Fixed in
    • Apple macOS 14.8.9
    • Apple macOS 15.7.9
    • Apple macOS 26.6.1
    • Apple macOS 26.7
    • Apple macOS 27

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: Vendor (CNA), CVSS v3

    9.8

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: BSI, CVE.org, pwn.watch

    1.7 %

    EPSS score

    Moderate — model estimates 1-10% exploitation likelihood.

    Source: FIRST EPSS, percentile 77.4

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    219.53 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploitedSource: VulnCheck KEV (opens in a new tab) How we classify
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    1.7 %
    Moderate — model estimates 1-10% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    77.4
    High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This flaw gives an unauthenticated network attacker full interactive GUI control of a Mac with no user interaction. The attacker inherits the logged-in session, so confidentiality, integrity and availability are all lost in one step. The modelled exploitation likelihood is only moderately elevated and CISA reports no ransomware use, but KEV listing confirms real-world attacks. Likely targets are exposed Screen Sharing services in creative, engineering and executive environments, and flat office networks. Treat any Mac with TCP 5900 reachable from the internet or untrusted segments as critical and remediate within 24 hours. Internal, segmented hosts with Screen Sharing disabled can follow in an accelerated regular patch cycle.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Scope the exposure: Query your MDM (Jamf, Intune, Kandji, etc.) for every Mac with Screen Sharing or Remote Management (Apple Remote Desktop) enabled. Start with hosts whose TCP 5900 is reachable from the internet, guest Wi-Fi or other VLANs.
      • Deploy the vendor fix: Update to macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, macOS Tahoe 26.6.1 or 26.7, or macOS Golden Gate 27. Push it via the ScheduleOSUpdate MDM command or a Declarative Device Management software-update enforcement with a short deadline. Flag anything older than 14.x for separate risk review.
      • Disable the service until patching is verified: Run sudo launchctl bootout system /System/Library/LaunchDaemons/com.apple.screensharing.plist. For ARD, run sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop. You can also turn it off under System Settings > General > Sharing.
      • Close external exposure now: Block inbound TCP 5900 and TCP/UDP 3283 at the perimeter and on VPN concentrators. Hunt for port forwards on branch-office and home-office routers, e.g. by checking your own IP ranges in Shodan or Censys.
      • Compromise assessment: For any host that was exposed before patching, preserve Screen Sharing session logs (see Detection). If you find unauthorised sessions, rotate local admin passwords and any credentials stored on the device (Keychain, SSH keys, browser sessions).

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: Allow TCP 5900 and 3283 only from a dedicated admin or jump-host subnet. Use ACLs or microsegmentation to deny east-west traffic on these ports between client VLANs, guest networks and IoT networks.
      • Host firewall: Enforce the Application Firewall with stealth mode through an MDM profile (com.apple.security.firewall). Add a pf anchor to restrict access, e.g. pass in proto tcp from <admin_net> to any port 5900 followed by block in proto tcp to any port 5900.
      • IAM/least privilege: Restrict Screen Sharing access to an explicit group (com.apple.access_screensharing). Disable "VNC viewers may control screen with password". Require VPN with MFA for any remote access.
      • Configuration hardening: Use an MDM restriction or custom settings payload to keep Screen Sharing and Remote Management off on every device without a business need. Track drift through compliance reporting.
      • IPS rule: Deploy a Suricata or Snort rule matching RFB handshakes (RFB 003. in the payload) from unauthorised source networks. Set it to alert at minimum, and preferably to drop.

    3. Runbook step 3

      Detection rules

      • macOS Unified Log: Run log show --predicate 'process == "screensharingd" OR subsystem == "com.apple.screensharing"' --last 7d and look for successful authentications and session starts. Watch for sessions with no preceding password or Kerberos check, unknown source IPs, and off-hours access.
      • Endpoint Security Framework / EDR: On macOS 15 and later, collect ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH events (fields: source address, authenticated user). Sigma shape: product: macos, event_type: screensharing_attach, filter: source_address not in admin_net.
      • Process ancestry: Treat shell or scripting processes (bash, zsh, osascript, curl) spawned in a session established via ScreensharingAgent or screensharingd as possible post-access activity.
      • Network telemetry (Zeek): Search rfb.log for port 5900 connections from outside the admin subnet. Prioritise entries with auth=T, an unusual authentication_method, or a very short gap between handshake and session start. Firewall KQL example: CommonSecurityLog | where DestinationPort in (5900,3283) and not(ipv4_is_in_range(SourceIP,"10.10.0.0/24")).
      • Perimeter logs: Correlate inbound TCP 5900 scans with successful connections to macOS hosts. A scan followed by a sustained session to the same host is a high-priority lead.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

    Source: BSI WID Portal, BSI CSAF, cvelistv5, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), pwn.watch

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    ApplemacOS
    • < 26.6.1
    • < 26.7
    • < 14.8.9
    • < 15.7.9
    • < 27
    • 26.6.1
    • 26.7
    • 14.8.9
    • 15.7.9
    • 27
    ApplemacOS Sequoia
    • < 15.7.9
    • 15.7.9
    ApplemacOS Sonoma
    • < 14.8.9
    • 14.8.9
    ApplemacOS Tahoe
    • < 26.6.1
    • 26.6.1

    Vendors and products

    Affected operating systems

    Affected operating systems
    macOSapplemacos—

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    PoC-in-GitHub (nomi-sec)CVE-2026-65400-poc (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-65400 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-65400 (opens in a new tab)github.comPoC (publicly reported)reported, not verified

    References & sources

    • support.apple.comApple macOS — CVE-2026-65400Release notes, Vendor advisory, pwn-watch
    • support.apple.comen-us/148171Release notes, Vendor advisory
    • support.apple.comen-us/148172Release notes, Vendor advisory
    • seclists.orgfulldisclosure/2026/Aug/36Mailing list
    • seclists.orgfulldisclosure/2026/Aug/37Broken link
    • advisories.ncsc.nl2026/ncsc-2026-0280.htmlThird-party advisory, Third-party advisory
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400government-resource, US government resource
    • support.apple.comen-us/149035Release notes, Vendor advisory
    • support.apple.comen-us/149042Release notes, Vendor advisory
    • pwn.watchpwn.watch: Apple macOS: Apple macOS Improper Authentication Vulnerabilitypwn-watch
    • NVD (NIST)NVD: CVE-2026-65400pwn-watch
    • cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. NVD analysis modifiedNVD

      Show 2 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Reference typeadded
      —
      Apple Inc.: https://support.apple.com/en-us/149035 Types: Release Notes, Vendor Advisory
      Reference typeadded
      —
      Apple Inc.: https://support.apple.com/en-us/149042 Types: Release Notes, Vendor Advisory

      Source identifier: nvd@nist.gov

    2. Record modifiedApple

      Description added or changed

      Show 13 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Descriptionchanged
      An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
      An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
      Affected versions (publisher)added
      —
      Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/65xxx/CVE-2026-65400.json">CVE-2026-65400</a>
      Referenceadded
      —
      https://support.apple.com/en-us/148170
      Referenceadded
      —
      https://support.apple.com/en-us/148171
      Referenceadded
      —
      https://support.apple.com/en-us/148172
      Referenceadded
      —
      https://support.apple.com/en-us/149035
      Referenceadded
      —
      https://support.apple.com/en-us/149042
      Referenceremoved
      https://support.apple.com/en-us/148170
      —
      Referenceremoved
      https://support.apple.com/en-us/148171
      —
      Referenceremoved
      https://support.apple.com/en-us/148172
      —
      Reference typeremoved
      https://support.apple.com/en-us/148170 Types: Release Notes, Vendor Advisory
      —
      Reference typeremoved
      https://support.apple.com/en-us/148171 Types: Release Notes, Vendor Advisory
      —
      Reference typeremoved
      https://support.apple.com/en-us/148172 Types: Release Notes, Vendor Advisory
      —

      Source identifier: product-security@apple.com

    3. Record modifiedCISA ADP

      Show 6 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://advisories.ncsc.nl/2026/ncsc-2026-0280.html
      Referenceadded
      —
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400
      Referenceremoved
      https://advisories.ncsc.nl/2026/ncsc-2026-0280.html
      —
      Referenceremoved
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400
      —
      Reference typeremoved
      https://advisories.ncsc.nl/2026/ncsc-2026-0280.html Types: Third Party Advisory
      —
      Reference typeremoved
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400 Types: US Government Resource
      —

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    4. Record modifiedCVE Program

      Show 6 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      http://seclists.org/fulldisclosure/2026/Aug/36
      Referenceadded
      —
      http://seclists.org/fulldisclosure/2026/Aug/37
      Referenceremoved
      http://seclists.org/fulldisclosure/2026/Aug/36
      —
      Referenceremoved
      http://seclists.org/fulldisclosure/2026/Aug/37
      —
      Reference typeremoved
      http://seclists.org/fulldisclosure/2026/Aug/36 Types: Mailing List
      —
      Reference typeremoved
      http://seclists.org/fulldisclosure/2026/Aug/37 Types: Broken Link
      —

      Source identifier: af854a3a-2127-422b-91ae-364da2661108

    5. Record modifiedCISA ADP

      CISA assessment (SSVC): exploitation: active, automatable: yes

      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      SSVC assessmentchanged
      {"id":"CVE-2026-65400","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-18T17:44:20.737833Z"}
      {"id":"CVE-2026-65400","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-14T00:00:00+00:00"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Show 5 older changes

    1. Record modifiedCISA ADP

      CISA assessment (SSVC): exploitation: none known, automatable: yes

      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      SSVC assessmentchanged
      {"id":"CVE-2026-65400","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-14T00:00:00+00:00"}
      {"id":"CVE-2026-65400","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-15T03:55:51.774517Z"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    2. Record modifiedCISA ADP

      CISA assessment (SSVC): exploitation: none known, automatable: yes

      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      SSVC assessmentchanged
      {"id":"CVE-2026-65400","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-14T17:13:14.334858Z"}
      {"id":"CVE-2026-65400","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-14T00:00:00+00:00"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    3. Initial analysis by NVDNVD

      Newly listed as affected:
      • Apple macOS (14.0 – before 14.8.9; 15.0 – before 15.7.9; 26.0 – before 26.6.1)
      Show 4 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationadded
      —
      OR *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions from (including) 14.0 up to (excluding) 14.8.9 *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions from (including) 15.0 up to (excluding) 15.7.9 *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions from (including) 26.0 up to (excluding) 26.6.1
      Reference typeadded
      —
      Apple Inc.: https://support.apple.com/en-us/148170 Types: Release Notes, Vendor Advisory
      Reference typeadded
      —
      Apple Inc.: https://support.apple.com/en-us/148171 Types: Release Notes, Vendor Advisory
      Reference typeadded
      —
      Apple Inc.: https://support.apple.com/en-us/148172 Types: Release Notes, Vendor Advisory

      Source identifier: nvd@nist.gov

    4. Record modifiedCISA ADP

      CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

      CISA assessment (SSVC): exploitation: none known, automatable: no

      Weakness type: CWE-287

      Show 3 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      CVSSadded
      —
      AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
      Weakness type (CWE)added
      —
      CWE-287
      SSVC assessmentadded
      —
      {"id":"CVE-2026-65400","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-08-07T00:16:06.397175Z"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    5. ReceivedApple

      Description added or changed

      Show 5 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Affected versions (publisher)added
      —
      macOS
      Descriptionadded
      —
      An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
      Referenceadded
      —
      https://support.apple.com/en-us/148170
      Referenceadded
      —
      https://support.apple.com/en-us/148171
      Referenceadded
      —
      https://support.apple.com/en-us/148172

      Source identifier: product-security@apple.com

    2 NVD translations into other languages are hidden.

    Linked advisories

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-65400
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-65400"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-65400.svg?lang=en" alt="CVE-2026-65400 – NEOSEC Intel" height="20"></a>