{"id":"CVE-2026-112473","kind":"vulnerability","aliases":["CVE-2026-112473"],"related":[],"title":"macOS Screen Sharing: legacy VNC password lets attackers copy files to the Mac","description":"An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with the legacy VNC password for Screen Sharing may be able to copy files to the Mac.","summary":"Apple's macOS Screen Sharing has an authorization flaw in which an attacker holding the legacy VNC password can copy files onto the Mac. Apple fixed it in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","macos","screen-sharing","vnc"],"not_affected_if":["no-vnc-password","screen-sharing-off"],"how_to_check":"- Run `sw_vers` on each Mac and compare the ProductVersion with the fixed releases.\n- Check whether Screen Sharing is enabled in System Settings > General > Sharing and whether VNC viewers may use a password.","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe).\n- Turn off Screen Sharing or disable VNC legacy password access if it is not needed.","status":"open","published_at":"2026-10-26T21:17:37+00:00","first_seen_at":"2026-10-26T21:20:26+00:00","triaged_at":"2026-10-26T21:30:10+00:00","updated_at":"2026-10-26T21:30:10+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:30:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe).\n- Turn off Screen Sharing or disable VNC legacy password access if it is not needed.","reach":"network","title":"macOS Screen Sharing: legacy VNC password lets attackers copy files to the Mac","impact":"medium","summary":"Apple's macOS Screen Sharing has an authorization flaw in which an attacker holding the legacy VNC password can copy files onto the Mac. Apple fixed it in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.","category":"infrastructure","nicknames":[],"who_cares":["macos","screen-sharing","vnc"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker copies files onto the Mac using the VNC password","analyst_note":"Check Apple's security notes for CVE-2026-112473 to confirm the affected builds and whether the flaw needs more than the VNC password.","how_to_check":"- Run `sw_vers` on each Mac and compare the ProductVersion with the fixed releases.\n- Check whether Screen Sharing is enabled in System Settings > General > Sharing and whether VNC viewers may use a password.","needs_analyst":true,"not_affected_if":["screen-sharing-off","no-vnc-password"],"who_is_affected":"Macs that have Screen Sharing turned on and accept the legacy VNC password can be reached by an attacker who has that password. Macs with Screen Sharing off, or with only macOS accounts and no VNC password, are not exposed. unknown whether exposure extends beyond the legacy VNC password path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3289,"output_tokens":639,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112473':16A,19A '-2026':15A,18A '15.8.2':59B,83C '26.7.2':62B,86C '27.2':57B,80C 'abl':99C 'address':67C 'appl':26B,50B 'attack':8A,38B,88C 'author':33B,64C 'copi':9A,45B,101C 'cve':14A,17A 'file':10A,46B,102C 'fix':51B,75C 'flaw':34B 'gate':56B,79C 'golden':55B,78C 'hold':39B 'improv':69C 'infrastructur':20B 'issu':65C,73C 'legaci':4A,41B,91C 'let':7A 'mac':13A,49B,105C 'maco':1A,21B,28B,54B,77C,81C,84C 'manag':71C 'may':97C 'onto':47B 'password':6A,43B,93C 'screen':2A,23B,29B,95C 'screen-shar':22B 'sequoia':58B,82C 'share':3A,24B,30B,96C 'state':70C 'taho':61B,85C 'vnc':5A,25B,42B,92C","nicknames":[],"mitigations":[],"who_affected":"Macs that have Screen Sharing turned on and accept the legacy VNC password can be reached by an attacker who has that password. Macs with Screen Sharing off, or with only macOS accounts and no VNC password, are not exposed. unknown whether exposure extends beyond the legacy VNC password path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112473","severity":null,"published_at":"2026-10-26T21:17:37+00:00","modified_at":"2026-10-26T21:17:37+00:00","first_seen_at":"2026-10-26T21:20:26+00:00","fetched_at":"2026-10-26T21:20:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}