Active Exploitation of CVE-2026-65400 in macOS Screen Sharing Deploys Monero Miner

The Netherlands National Cyber Security Centre (NCSC-NL) has warned of active exploitation of a critical vulnerability in Apple macOS. Tracked as CVE-2026-65400, the flaw is an authentication issue within the Screen Sharing component that carries a CVSS score of 9.8. According to the advisory, the vulnerability allows an attacker who is already on the network to bypass authentication mechanisms in Screen Sharing, potentially achieving remote code execution on affected systems.

The exploitation is occurring in the wild, with attackers using the vulnerability to deploy a Monero cryptocurrency miner on compromised machines. The NCSC-NL advisory specifically identifies internet-exposed macOS systems as targets. While the exact initial access vector details remain under investigation, the confirmed activity indicates that threat actors are leveraging the authentication bypass to gain control of affected devices.

Apple has addressed the vulnerability through security updates. The NCSC-NL and other security bodies recommend that all macOS users and administrators apply the latest available updates to mitigate the risk. No public exploit code has been confirmed at the time of reporting.