---
id: "CVE-2026-65400"
kind: "vulnerability"
aliases: ["CVE-2026-65400"]
title: "apple macos: An authentication issue was addressed with improved state management"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple macOS", "fixed": ["14.8.9", "15.7.9", "26.6.1", "26.7", "27"], "affected": "< 14.8.9 (Sonoma), < 15.7.9 (Sequoia), < 26.6.1 (Tahoe)", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["14.8.9"], "affected": ">= 14.0, < 14.8.9", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["15.7.9"], "affected": ">= 15.0, < 15.7.9", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.6.1"], "affected": ">= 26.0, < 26.6.1", "ecosystem": "vendor"}, {"name": "Apple macOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisa-kev", "exploited", "mac-fleet", "macos", "poc-public", "screen-sharing", "self-hosted", "vendor"]
not_affected_if: ["screen-sharing-off"]
published_at: "2026-08-06T22:18:14+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65400", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:41:27+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65400", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# apple macos: An authentication issue was addressed with improved state management

macOS Screen Sharing can be reached over the network and accepts a login without valid credentials. An attacker who reaches the Screen Sharing service can take control of the Mac's screen and input.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple macOS affected < 14.8.9 (Sonoma), < 15.7.9 (Sequoia), < 26.6.1 (Tahoe) fixed 14.8.9, 15.7.9, 26.6.1, 26.7, 27
- vendor:apple macos affected >= 14.0, < 14.8.9 fixed 14.8.9
- vendor:apple macos affected >= 15.0, < 15.7.9 fixed 15.7.9
- vendor:apple macos affected >= 26.0, < 26.6.1 fixed 26.6.1
- vendor:Apple macOS affected ? fixed ?

## How to check

Check System Settings > General > Sharing: Screen Sharing is off or restricted to named users. Confirm the macOS version with sw_vers against the fixed builds.

## Fix

Update to macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9, or later. Until patched, turn off Screen Sharing or block its port from untrusted networks.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65400
- 2026-10-23T21:41:27+00:00 analyst — Apple advisories (Sequoia 15.7.9, Tahoe 26.6.1, released 2026-08-06) confirm fix; NVD/CVE.org list Sonoma 14.8.9, Tahoe 26.7, macOS 27 as fixed too (Sonoma/26.7/27 Apple pages not read). KEV added 2026-08-18, due 2026-08-21. Exploited (NCSC-NL: port 5900 exposed, root, Monero miner); public PoCs exist (panchocosil read-only; others write/RCE, one repo looks untrustworthy). CVSS 9.8 CNA; Ars cites 7.1. X/Bluesky not searched.
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65400

## Documents

- [advisory] Apple: macOS Sequoia 15.7.9 security content https://support.apple.com/en-us/148171
- [advisory] Apple: macOS Tahoe 26.6.1 security content https://support.apple.com/en-us/148170
- [describes] NVD CVE-2026-65400 (KEV due date) https://nvd.nist.gov/vuln/detail/cve-2026-65400
- [discussion] Calif: No Country for Old Passwords (exploit analysis) https://blog.calif.io/p/no-country-for-old-passwords
- [mitigation] Ars Technica: exploited in the wild, NCSC-NL, Sharing toggle https://arstechnica.com/security/2026/08/vulnerability-giving-attackers-full-control-of-macs-is-under-active-exploitation/
- [poc] panchocosil read-only PoC https://github.com/panchocosil/CVE-2026-65400-poc

## From the sources

Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_