Apple's macOS Screen Sharing Flaw Is Being Exploited in the Wild - MacRumors
Skip to Content

Apple's macOS Screen Sharing Flaw Is Being Exploited in the Wild

by

The screen sharing flaw that Apple rushed out a fix for earlier this month has already been exploited in the wild, according to the Netherlands' National Cyber Security Center (NCSC-NL).

macOS Tahoe Finder Bug Underscores Apples Slipping UI Polish Feature
On August 6, Apple released macOS Tahoe 26.6.1, an update to the ‌macOS Tahoe‌ operating system that came out last year. The update came a little over a week after Apple released macOS Tahoe 26.6.

In its security support document, Apple said that the update addressed a vulnerability that could allow an attacker to authenticate to Screen Sharing without valid credentials – in short, a bad actor could view a user's Mac screen and remotely take control of their keyboard and mouse. It appears however that hackers have already been taking advantage of the flaw.

As first reported by ArsTechnica, the NCSC-NL said that it had been notified of abuse of the vulnerability, "observed on multiple systems on which port 5900 was accessible from the internet." The reason is that when screen sharing is enabled, macOS's firewall intentionally exposes this port.

"In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed," the NCSC-NL added. In other words, a targeted Mac's resources are used to mine cryptocurrency.

When pushing the fix – which was also included in macOS Sonoma 14.8.9 and macOS Sequoia 15.7.9 – Apple said it had addressed the authentication issue with "improved state management." Users who have not updated their Macs should do so as soon as possible. Even for those who have updated, use of a VPN is also recommended when screen sharing is active.

If you're not sure if your macOS version is up-to-date, you can check by going into your Mac's System Settings and selecting General ➝ Software Update.

Popular Stories

Four iPhone 18 Pro Colors Mock Feature

iPhone 18 Pro: Pre-Orders and Release Date

Sunday August 16, 2026 8:24 pm PDT by
Apple has yet to reveal when the iPhone 18 Pro and iPhone Ultra will be announced and released, but the dates usually follow a familiar pattern. As usual, the event is expected to take place in the first half of September. Labor Day falls on September 7 this year. The last time the holiday was on that day was in 2020, but the iPhone event that year was delayed until October due to the...
Read Full Article
iPhone 18 Pro Rumored Colors

What's Coming in September: New iPhones, Apple Watches and More

Thursday August 13, 2026 4:20 pm PDT by
Apple will introduce at least five new devices at its iPhone-centric event next month, and it's also possible we'll get devices waiting on Siri AI like the Apple TV. iPhone 18 Pro The iPhone 18 Pro is going to look like the iPhone 17 Pro, but with a smaller Dynamic Island. It's getting some internal updates, including a new Wide camera with a variable aperture for more control over lighting ...
Read Full Article • 25 comments
iPhone 17 One Year Later Thumb 1

Should You Buy an iPhone 17 Now or Wait for iPhone 18?

Friday August 14, 2026 12:15 pm PDT by
For the first time since Apple started selling standard and "Pro" iPhones, we're not going to get an entry-level iPhone model this fall. Apple doesn't plan to release an iPhone 18 in September, and will only launch the iPhone 18 Pro, iPhone 18 Pro Max, and foldable iPhone Ultra. The lower-cost iPhone 18 won't come out until spring 2027. Subscribe to the MacRumors YouTube channel for more ...
Read Full Article • 115 comments

Top Rated Comments

jchap Avatar
jchap
7 hours ago at 05:35 am

personal alternative: never installing Tahoe to begin with
The fix was also required and issued for Sonoma and Sequoia; it is not particular to Tahoe.
Score: 29 Votes (Like | Disagree)
chucker23n1 Avatar
chucker23n1
5 hours ago at 07:09 am

Does the vulnerability persist if Screen Sharing is Off?
No.


Note that Apple generally leaves every possible "daemon" or "service" running regardless of whether it is being used / turned off.
It's the opposite: they generally design their daemons such that they only run when a socket is open. That's also true of screensharingd. You can easily try this yourself:

[LIST=1]
* With Screen Sharing disabled, open Activity Monitor, and search for screensharingd. You probably won't find it.
* Now in Terminal, do telnet localhost 5900. This will fail with "connection refused", as there's nothing listening. screensharingd still won't be running, of course.
* Now turn it on. Notice that screensharingd still isn't running!
* Finally, try telnet localhost 5900 again. This time, it'll work, and the very act of connecting to that port is what actually launches the daemon.

This is a mechanism in launchd with security and energy benefits. Instead of having screensharingd constantly listening for connections, launchd does the listening:

<key>Sockets</key>
<dict>
<key>Listener</key>
<dict>
<key>Bonjour</key>
<string>rfb</string>
<key>SockServiceName</key>
<string>vnc-server</string>
</dict>
</dict>




1) Enable Firewall (which for some reason defaults to off despite all the kabuki theater of Apple security)
I don't think that would do anything useful in this scenario. If you don't want Screen Sharing to accept connections, just leave it off. If you do, you'll also need to let the firewall allow it in.


3) Ensure everything in Sharing is off as well as all options under them (belts and suspenders people belts and suspenders)
Sure, but that's the default anyway.
Score: 7 Votes (Like | Disagree)
I
ignatius345
6 hours ago at 06:21 am
Of note: the default setting for Screen Sharing is OFF on macOS. So, unless you've specifically switched it on AFAIK you're not vulnerable to this particular exploit.
Score: 7 Votes (Like | Disagree)
M
MilaM
6 hours ago at 05:54 am

How vulnerable is a computer behind a cable modem, etc. with a local IP address (10.0.*.*, 192.168.*.*)?
I would like to know that too. Most internet routers should block incoming connections from the Internet by default. Unless you explicitly forward all (or selected) ports to your Mac of course. But the article above is very not clear about that.
Score: 5 Votes (Like | Disagree)
ScooterComputer Avatar
ScooterComputer
5 hours ago at 07:46 am
It might should be noted that several ISPs in the U.S. (at least), eg Comcast, have been enabling IPv6 on their consumer-rented routers without really advising customers that it is happening, or requiring opt-in. WHEN this happens, while there IS a firewall that runs on the router, your LAN-local devices that were once 'protected' by an IPv4 NAT firewall suddenly are ass-out on the internet, relying nearly entirely on whatever firewall is running locally, IF a firewall is even running locally. Worse, older hardware—like multifunction printers—often had IPv6 enabled, but often not particularly well-tested (ie buggy), and had firmware vulnerabilities and static passwords (or passwords based on MAC address) that attackers have long since targeted… this gives an attacker a secondary vector: they get control of a mfc, and can then jump (from inside the same subnet) to other vulnerable devices that would ordinarily have been protected by firewall, but because firewall rules often allow LAN-local peer-to-peer communications (as Apple's firewall in macOS does), are bypassed.
This problem is going to get worse as more ISPs do this nonsense and A.I. fuzzes out more and more vulnerabilities in older code. IPv6 is great, but it cannot and should not be entered into lightly. And irresponsible ISPs have been throwing non-tech-savvy customers into the deep end of the pool without floaties.
Score: 4 Votes (Like | Disagree)
Steve Adams Avatar
Steve Adams
5 hours ago at 06:54 am

Which are?
Linux and Windows.....
Score: 4 Votes (Like | Disagree)
Read All Comments