A serious vulnerability in macOS called CVE-2026-65400 is being actively exploited to give attackers complete control of affected machines. The flaw bypasses authentication in Screen Sharing, allowing unauthorized users to gain root-level access without credentials.
Attackers are primarily using this vulnerability to install cryptocurrency miners on compromised devices. These miners degrade system performance, drain battery life, and increase power consumption significantly. However, the attack requires the target machine to have port 5900 exposed to the internet, which limits the attack surface to systems with specific network configurations.
Apple has patched this vulnerability in the latest versions of macOS Tahoe, Sequoia, and Sonoma. Users should update immediately to protect their systems from active exploitation.