Apple's macOS Screen Sharing Flaw Is Being Exploited in the Wild - MacRumors
Skip to Content

Apple's macOS Screen Sharing Flaw Is Being Exploited in the Wild

by

The screen sharing flaw that Apple rushed out a fix for earlier this month has already been exploited in the wild, according to the Netherlands' National Cyber Security Center (NCSC-NL).

macOS Tahoe Finder Bug Underscores Apples Slipping UI Polish Feature
On August 6, Apple released macOS Tahoe 26.6.1, an update to the ‌macOS Tahoe‌ operating system that came out last year. The update came a little over a week after Apple released macOS Tahoe 26.6.

In its security support document, Apple said that the update addressed a vulnerability that could allow an attacker to authenticate to Screen Sharing without valid credentials – in short, a bad actor could view a user's Mac screen and remotely take control of their keyboard and mouse. It appears however that hackers have already been taking advantage of the flaw.

As first reported by ArsTechnica, the NCSC-NL said that it had been notified of abuse of the vulnerability, "observed on multiple systems on which port 5900 was accessible from the internet." The reason is that when screen sharing is enabled, macOS's firewall intentionally exposes this port.

"In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed," the NCSC-NL added. In other words, a targeted Mac's resources are used to mine cryptocurrency.

When pushing the fix – which was also included in macOS Sonoma 14.8.9 and macOS Sequoia 15.7.9 – Apple said it had addressed the authentication issue with "improved state management." Users who have not updated their Macs should do so as soon as possible. Even for those who have updated, use of a VPN is also recommended when screen sharing is active.

If you're not sure if your macOS version is up-to-date, you can check by going into your Mac's System Settings and selecting General ➝ Software Update.

Popular Stories

Four iPhone 18 Pro Colors Mock Feature

iPhone 18 Pro: Pre-Orders and Release Date

Sunday August 16, 2026 8:24 pm PDT by
Apple has yet to reveal when the iPhone 18 Pro and iPhone Ultra will be announced and released, but the dates usually follow a familiar pattern. As usual, the event is expected to take place in the first half of September. Labor Day falls on September 7 this year. The last time the holiday was on that day was in 2020, but the iPhone event that year was delayed until October due to the...
Read Full Article
apple camera airpods

Apple's Camera-Equipped AirPods Confirmed: See Them in Action

Monday August 17, 2026 6:21 pm PDT by
Apple is working on camera-equipped AirPods that appear to be nearly ready to launch, based on a video MacRumors found in the macOS Tahoe 26.7 release candidate. In a short demo, a man holds a book up so the camera in the AirPods can see the title. "With Visual Intelligence, your world becomes savable. See something you like? Just ask me to save it for later," says the voiceover text. Here ...
Read Full Article • 313 comments
iPhone 18 Pro Dark Cherry Feature

iPhone 18 Pro and iPhone Ultra: New Details Leak as Apple Event Nears

Monday August 17, 2026 11:09 am PDT by
"iPhone Ultra" supply will be very limited when the foldable device is first released later this year, according to Fixed Focus Digital, a known leaker on the Chinese social media platform Weibo. The account also claimed that the iPhone 18 Pro's A20 Pro chip will be up to 18% faster and up to 30% more power efficient compared to the iPhone 17 Pro's A19 Pro chip. The A20 Pro chip will be the...
Read Full Article • 32 comments

Top Rated Comments

jchap Avatar
jchap
3 days ago at 05:35 am

personal alternative: never installing Tahoe to begin with
The fix was also required and issued for Sonoma and Sequoia; it is not particular to Tahoe.
Score: 32 Votes (Like | Disagree)
chucker23n1 Avatar
chucker23n1
3 days ago at 07:09 am

Does the vulnerability persist if Screen Sharing is Off?
No.


Note that Apple generally leaves every possible "daemon" or "service" running regardless of whether it is being used / turned off.
It's the opposite: they generally design their daemons such that they only run when a socket is open. That's also true of screensharingd. You can easily try this yourself:

[LIST=1]
* With Screen Sharing disabled, open Activity Monitor, and search for screensharingd. You probably won't find it.
* Now in Terminal, do telnet localhost 5900. This will fail with "connection refused", as there's nothing listening. screensharingd still won't be running, of course.
* Now turn it on. Notice that screensharingd still isn't running!
* Finally, try telnet localhost 5900 again. This time, it'll work, and the very act of connecting to that port is what actually launches the daemon.

This is a mechanism in launchd with security and energy benefits. Instead of having screensharingd constantly listening for connections, launchd does the listening:

<key>Sockets</key>
<dict>
<key>Listener</key>
<dict>
<key>Bonjour</key>
<string>rfb</string>
<key>SockServiceName</key>
<string>vnc-server</string>
</dict>
</dict>




1) Enable Firewall (which for some reason defaults to off despite all the kabuki theater of Apple security)
I don't think that would do anything useful in this scenario. If you don't want Screen Sharing to accept connections, just leave it off. If you do, you'll also need to let the firewall allow it in.


3) Ensure everything in Sharing is off as well as all options under them (belts and suspenders people belts and suspenders)
Sure, but that's the default anyway.
Score: 13 Votes (Like | Disagree)
I
ignatius345
3 days ago at 06:21 am
Of note: the default setting for Screen Sharing is OFF on macOS. So, unless you've specifically switched it on AFAIK you're not vulnerable to this particular exploit.
Score: 8 Votes (Like | Disagree)
M
MilaM
3 days ago at 05:54 am

How vulnerable is a computer behind a cable modem, etc. with a local IP address (10.0.*.*, 192.168.*.*)?
I would like to know that too. Most internet routers should block incoming connections from the Internet by default. Unless you explicitly forward all (or selected) ports to your Mac of course. But the article above is very not clear about that.
Score: 7 Votes (Like | Disagree)
Steve Adams Avatar
Steve Adams
3 days ago at 06:54 am

Which are?
Linux and Windows.....
Score: 6 Votes (Like | Disagree)
B
Bokito
3 days ago at 06:11 am
As I suggested in the other thread Apple should backport this fix to 10.14 and later (if needed) since those OSes are in active use. If they’re not vulnerable Apple should communicate that. They now leave open a very serious security issue that’s easy to exploit and gives a bad actor instant root access. That’s very, very bad.
Score: 5 Votes (Like | Disagree)
Read All Comments