Catalog analysis: CISA added this entry on August 18, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.
What the vulnerability is
CVE-2026-65400 is an improper authentication vulnerability (CWE-287) affecting Apple macOS. The flaw allows a network-based attacker to authenticate to the Screen Sharing service without providing valid credentials. Because this bypass occurs at the authentication layer, it could grant unauthorized remote access to the system.
Exposure and applicability
This vulnerability specifically impacts macOS systems where the Screen Sharing feature is enabled and accessible over the network. The risk is highest for assets with direct internet exposure or those residing on untrusted network segments where an attacker can reach the service port.
Given its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of August 18, 2026, this vulnerability should be treated as a high-priority remediation target for infrastructure owners and security leaders.
Remediation priorities
Our analysis suggests prioritizing assets based on their network visibility and the criticality of the data they host. We recommend the following sequence:
- Identify Exposed Assets: Use asset inventory tools to locate all macOS devices with Screen Sharing enabled. Priority should be given to those reachable via external-facing interfaces.
- Apply Vendor Mitigations: Implement the corrective actions provided in Apple’s official security guidance.
- Restrict Network Access: As a compensating control, limit access to the Screen Sharing service to known, trusted IP addresses or require a VPN for connectivity, reducing the attack surface while patching is underway.
How to validate remediation
Verification must go beyond confirming that a software update was installed. To ensure exposure has been reduced, defenders should employ the following validation methods:
- Configuration Audit: Verify through system settings or configuration management tools that the Screen Sharing service is either disabled (if not required) or configured according to the vendor’s updated security specifications.
- Network Connectivity Testing: Perform authorized scans from a segmented network position to confirm that the Screen Sharing port is no longer accessible to unauthorized sources.
- Authentication Verification: In a controlled test environment, attempt to initiate a Screen Sharing session using an account without valid credentials to ensure the authentication bypass is no longer functional.
Limits and open questions
A version check alone does not prove mitigation, as the effectiveness of the fix depends on the active configuration of the Screen Sharing service. It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, while CISA has set a remediation deadline of August 21, 2026, for federal agencies, non-federal organizations must determine their own timelines based on their specific risk profile and asset exposure.
Source and editorial note
CVE-2026-65400: Apple macOS Improper Authentication Vulnerability · Source date: August 18, 2026 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗