Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-65400 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-08-18 |
| Vendor | Apple |
| Product | macOS |
| CVSS Score | 9.8 (critical) |
| EPSS Score | 0.5% (percentile: 40%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-08-21 |
Vulnerability Description
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
Required Actions
This vulnerability is listed in CISA KEV, with a remediation deadline of August 21, 2026.
- Update macOS to Sequoia 15.7.9, Sonoma 14.8.9 or Tahoe 26.6.1, depending on your branch. All three lines received the fix on the same day.
- Until you can update, disable Screen Sharing where it is not needed: System Settings → General → Sharing → Screen Sharing. This is the only effective mitigation, since the attack requires no credentials at all.
- Note the attack vector: it requires access to the same network. The real risk is therefore in office networks, guest Wi-Fi and shared networks — not machines behind home NAT.
- If you operate MDM, enforce the update rather than relying on users. Macs are often outside the standard patching cycle that covers Windows workstations.
Who Is Affected?
Organizations with Macs in use — even a handful, in design teams, marketing or at board level. The risk increases in open office networks, where being on the same network segment is enough to carry out the attack.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
