Published on 7 August 2026
Until just a few days ago, an attacker on the same Wi-Fi network as your Mac – in the office, at a hotel or in a co-working space – could take complete control of macOS systems. Without a password, without a single click from the victim, and in under 60 seconds to root access, meaning the highest privilege level on the system. The cause is a critical vulnerability in macOS screen sharing that Apple closed with out-of-band updates on 6 August 2026. The flaw carries the identifier CVE-2026-65400.
If you use Macs in your company and have screen sharing enabled (for example for IT support or remote maintenance), you should read this article to the end – and then act immediately.
On 6 August 2026, Apple released no fewer than three out-of-band security updates for the currently supported macOS versions:
All three updates close the same critical flaw: an authentication bypass in the screen-sharing feature. Screen Sharing is the screen-sharing capability built into macOS that lets you view and control a Mac remotely. Apple describes the issue matter-of-factly in its official security bulletin:
„An authentication issue was addressed with improved state management. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials." – Apple Security Advisory (support.apple.com/en-us/148170)
In plain terms: an attacker on the network could log in to screen sharing without valid credentials. And whoever logs in can control the Mac remotely, as if sitting right in front of it.
The vulnerability was discovered by security researcher Alfredo Pesoli (@__rev) via Bynario Atlas, the AI-assisted analysis platform of the Italian cybersecurity startup Bynario. Notably, Bynario had already reported several other screen-sharing flaws to Apple a short time earlier, on 27 July 2026 (CVE-2026-43760, CVE-2026-43779, CVE-2026-43777), which were fixed in macOS 26.6. Less than two weeks later came this further, particularly serious find.
The flaw lies in a background service called screensharingd. This is the program that runs behind the scenes and manages screen sharing. It normally checks whether someone is authorised to connect – for example by verifying the password.
The bug was in precisely that check. When the service received a data packet marked as "too large," it wrongly returned the success code of a previous read operation – instead of reporting an error. Put simply: the system thought the login had already succeeded and skipped the entire security check. No password check, no key exchange, no encryption. The attacker obtained a fully authorised session – in cleartext, that is, unencrypted.
In addition, the researchers found a second, independent weakness in the so-called SRP check (Secure Remote Password, a secure login procedure). Certain malformed values were not rejected, which made the shared session key predictable.
What became possible after that is alarming. From this unauthenticated session, Apple's built-in file-copy protocol could be used to read and write the entire hard drive – with root privileges, i.e. the highest system rights. Read access exposed home folders, log files, app data and configurations. Write access allowed files to be placed anywhere.
Apple's protection mechanism System Integrity Protection (SIP) – a safeguard that protects core system areas from modification – does block the most direct attack paths. However, the researchers demonstrated a SIP-compliant workaround: planting a passwordless sudo rule and a shell startup hook. The security service Cyber Kendra sums it up this way:
„A pre-auth flaw in macOS Screen Sharing let attackers gain root over the network with no password. In the researchers' tests, a single pipelined connection could drop a root shell in under 60 seconds." – Cyber Kendra
An important point for context: the attack vector is limited to the local network (marked in the CVSS vector with "AV:A" for Adjacent Network). The attacker must therefore be physically on the same network segment – a pure remote internet attack was not possible according to current knowledge. Apple journalist Adam Engst of TidBITS puts it this way:
„Apple's wording suggests to me that Screen Sharing is vulnerable to unauthenticated connections over the local network, not the Internet." – Adam Engst, TidBITS
Heise Security editor Ben Schwan, however, points out that it is unclear whether the flaw is also exploitable when companies have set up access from the internet. And he stresses its significance: "With Screen Sharing, an attacker can remotely control the entire Mac as if they were a local user. Such an attack is correspondingly dangerous."
In principle, all Macs running the following unpatched macOS versions are affected:
The crucial point, however: the flaw is only exploitable if screen sharing has been enabled. On new Macs this feature is disabled by default. In many small and medium-sized businesses, though, it is deliberately turned on – for example for remote maintenance by IT or for remote working. That is precisely where the risk lies.
To give a sense of scale: in Germany, macOS holds a desktop market share of around 21 percent (StatCounter, July 2026). Shortly before the patch, macOS 26.5 alone ran on nearly 65 percent of all tracked macOS systems – all of these systems were vulnerable to CVE-2026-65400. So the exposure is anything but a niche problem.
There is no confirmed active exploitation in the wild as of now – neither Apple nor the reporting media have reported any.
For German SMEs, this flaw is not only a technical but also a legal matter. If an attacker succeeds in accessing personal data – customer or employee data, business documents – this constitutes a reportable data breach under Art. 33 GDPR. In that case, the competent data protection authority must be informed without undue delay, ideally within 72 hours of becoming aware of it.
Because the flaw allows full read access to the entire hard drive including home folders and app data, as well as write access, an exploitation scenario is a classic case of a serious data breach. In addition, there may be an obligation to notify the affected individuals under Art. 34 GDPR if there is a high risk to their rights and freedoms.
Equally important: anyone who fails to update promptly despite an available patch risks fines for insufficient technical protective measures under Art. 32 GDPR. German authorities have in the past imposed fines ranging from several thousand to several hundred thousand euros for such failings; across Europe, GDPR fines totalled over 5.6 billion euros up to 2025.
Our tip: Document all measures – when you installed the patch, checked the logs and assessed the risk. This is your evidence for the accountability obligation under Art. 5(2) GDPR.
We rate the risk for German SMEs as high – especially where Macs with screen sharing enabled are operated on office networks or public networks. Three scenarios are realistic above all: an insider or visitor on the office network, an already compromised device used as a springboard on the same network, and employees working with screen sharing enabled on hotel or public Wi-Fi.
The good news: since the attack vector is limited to the local network, no active exploitation is known and the patch is already available, the residual risk drops to a negligible level once the update is installed. For versions no longer supported, such as Ventura and older, a permanent residual risk remains because no patch is provided.
CVE-2026-65400 is one of the more dangerous types of vulnerability: it requires no user interaction, no password, and in the event of success delivers complete control over the system – in under a minute. The fact that the attack is limited to the local network reduces the risk but does not eliminate it, because office, hotel and co-working networks are precisely the environments where mobile employees operate.
The course of action is clear: Update now. Install macOS Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9 on all affected devices. Where an immediate update is not possible, temporarily turn off screen sharing. And document your steps – in an emergency, this is your most important evidence to present to the data protection authority. Adam Engst of TidBITS puts it in a nutshell: the possibility that an unauthenticated user could observe or control someone else's Mac is worrying enough to recommend that everyone update as soon as it is convenient.