The screen sharing flaw can grant Mac the highest privileges

The NCSC recently issued a security alert, stating that a high-risk vulnerability in macOS has been exploited in real network environments. A large number of Mac hosts that expose port 5900 to the outside have been invaded. After hackers successfully invade, they can directly obtain the root administrator privileges of the device. Among the attack cases collected so far, the first action taken by the attackers after entering the system is to deploy the Monero mining program.

The mining program will secretly occupy the CPU computing power of the Mac, continuously consuming electricity, causing the device to heat up and run slowly. From the current monitoring situation, the attackers have only deployed mining machines so far and have not implanted malware or stolen account passwords on a large scale. However, security experts warn that this level of privilege is sufficient for attackers to perform any operation, and subsequent attack methods can be upgraded at any time. Apple has also released security patches for several mainstream versions of macOS, namely Tahoe, Sequoia and Sonoma.

Vulnerability ID: CVE-2026-65400, CVSS severity level 7.1. The vulnerability lies in the built-in screen sharing feature of macOS. Screen sharing is the native VNC remote desktop service of macOS, allowing others to remotely view the screen and control the keyboard and mouse. This function has an internal status management mechanism to save user interactions, operation records, and various system variables. This mechanism has a logical flaw, which became the breakthrough point for this attack.

Apple's statement in the announcement is relatively conservative, describing it as "possibly allowing attackers without credentials to access the Mac". Industry security experts explain that this sentence means that the attacker can launch an attack attempt without a username and password. For the attack to take effect, there is a key prerequisite - Port 5900 of the Mac is exposed to the public network. Once screen sharing is enabled, the macOS firewall will default to opening port 5900. Home routers and enterprise firewalls usually default to blocking this port. If the user manually performs port mapping, hackers from the external network can directly scan this Mac.

Many ordinary users are not aware of the connection between screen sharing and port 5900. When screen sharing is enabled, the system will start the VNC service and listen on port 5900. Using the internal network environment itself poses little risk. Once port forwarding is configured on the router and port 5900 is mapped to the public network, the risk will sharply increase. Hackers will use automated scanning tools to search for hosts with open port 5900 across the entire network. Once the target is identified, they will send specially crafted data packets to exploit the state management vulnerability and bypass authentication.

When the vulnerability is successfully triggered, the attacker gets root privileges. Root privileges are the highest level of privileges in macOS system and enable the read and write access to almost all files, modifying the system configurations and installing background programs. The attacker does not need user interaction, and the background mining machine can remain for a long time. The current attack sample only deploys mining programs, which does not mean that the vulnerability itself is limited in capability. Under root privileges, the attacker can implant remote control malware and even modify the underlying system files. At present, the black market focuses on Mac computing power and prioritizes using it for mining Monero.

The most reliable solution is to immediately install the security updates released by Apple. This patch fixes the state management problem in the screen sharing module. It closes the loophole at its source. In addition, daily usage habits also need to be adjusted. When the screen sharing function is not in use, simply turn it off. If a remote connection to the Mac is truly necessary, it is not recommended to directly open port 5900 on the public network.

The industry recommends two alternative solutions. The first one is VPN, where you first connect to the internal network and then access the Mac. The second one is SSH tunneling, where the VNC traffic is encapsulated in an encrypted channel. Neither of these two methods exposes port 5900 to the public network directly. However, these two solutions have certain thresholds for ordinary users. Either VPN or SSH tunneling requires simple network configuration, and many individual users are not familiar with the operation. Therefore, for most people, the simplest strategy is to keep the screen sharing turned off.

Many design teams will enable screen sharing on Mac workstations to facilitate remote access by the team and will also configure port mapping for external network access. A large number of Mac workstations are left on for 24 hours and are online continuously. Once they are invaded, multiple devices are simultaneously infected with mining machines, resulting in rapid increases in computing power loss and electricity costs. Administrators may not be able to detect anomalies immediately, and the mining process can be disguised as system processes.