Apple macOS Screen Sharing Authentication Bypass — CVE-2026-65400

An attacker who can reach TCP/5900 on a Mac needs nothing but an IP address: CVE-2026-65400 is an authentication-bypass flaw in screensharingd, the daemon behind macOS's built-in Screen Sharing / VNC feature, caused by the Secure Remote Password (SRP) handshake's frame-length validator returning a stale success status instead of correctly rejecting malformed authentication data — the connection is then treated as authenticated with no valid credential ever supplied. From there the attacker rides the entitled SSFileCopySender/SSFileCopyReceiver file-transfer helpers (which carry the kTCCServiceSystemPolicyAllFiles entitlement) to read and write any file as root, install an SSH key and a KeepAlive LaunchDaemon for persistence, and drop XMRig 6.26.0 disguised as a hidden .config/sysmond binary masquerading as com.apple.airportd.

NCSC-NL confirmed active exploitation on multiple internet-exposed hosts on August 12, 2026 — in every case investigated, the attacker obtained root and installed a Monero miner. Microsoft Threat Intelligence confirmed exploitation was still ongoing as of August 18, 2026, the same day CISA added the CVE to its Known Exploited Vulnerabilities catalog. Apple shipped the fix on August 6, 2026 (macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9); CISA subsequently rescored the bug from CVSS 7.1 to 9.8 on August 14 after assessing the attack as automatable. Public proof-of-concept code has been available since on or before August 12. An independent researcher scan found roughly 40,000 internet-reachable macOS Screen Sharing hosts, concentrated in U.S. residential IP space with a meaningful tail in university and institutional networks.

The single highest-value defensive move is exposure elimination, not detection: this is a pre-auth bug, so rotating VNC passwords, pruning allowed accounts, or disabling legacy VNC auth do nothing to close it — only patching (or removing the service from the internet) does. Detection in this pack is built to cover what happens after exposure — the process-tree, persistence, and cryptomining behaviors — because Falcon has no native visibility into the pre-auth SRP handshake itself.

Defender priority: Inventory every Mac with Screen Sharing / Remote Management enabled, confirm none has TCP/5900 reachable from the internet, and patch to Tahoe 26.6.1 / Sequoia 15.7.9 / Sonoma 14.8.9 today — this is a CISA KEV entry with a due date of 2026-08-21 and an automatable, root-yielding pre-auth exploit already active in the wild.

Correction to initial intake: the three related CVEs (2026-43779, 2026-43777, 2026-43760) were not patched in the same August 6, 2026 advisory as CVE-2026-65400. Apple's own advisory pages (support.apple.com/en-us/148170, /148171) list only CVE-2026-65400 for the August 6 releases. NVD confirms all three related CVEs were published 2026-07-27 and fixed in macOS Tahoe 26.6 / Sequoia 15.7.8 / Sonoma 14.8.8 — a separate, earlier out-of-band update. CVE-2026-43760 in particular (the "confused-context" legacy-VNC file-copy privilege issue Huntress covers alongside 65400) requires the attacker to already hold valid legacy VNC credentials; it is a related but distinct bug from the pre-auth 65400 flaw this pack targets. Both are covered below where their telemetry overlaps.

Tier	Source	Key Finding	Carry Forward
1	Apple Security Advisory (support.apple.com/en-us/148171, 148170)	Official CVE-2026-65400 description, discovery credit (Alfredo Pesoli / Bynario Atlas), patched versions, Aug 6 2026 release date	Yes
1	NVD CVE-2026-65400 / 43760 / 43779 / 43777 (JSON records)	CVSS vectors, CWE-287, CISA KEV add date (2026-08-18), due date (2026-08-21), automatable SSVC rating, exact patch/version ranges	Yes
1	CISA KEV Catalog alert (2026-08-18)	Formal KEV addition, BOD 26-04 remediation requirement, "Apple macOS Improper Authentication Vulnerability" name	Yes
1	Bynario Atlas blog (bynar.io) — discoverer's own writeup	Technical background on the related CVE-2026-43760 confused-context VNC file-copy bug; clarifies it as post-auth and distinct from 65400; CVSS 5.5 (Bynario's own scoring) vs 8.6 (NVD/CISA rescoring) — noted discrepancy, NVD figure used	Partial
2	NCSC-NL advisory (via Malwarebytes, Help Net Security, Tom's Hardware, SecurityWeek reporting)	Active exploitation confirmed 2026-08-12; root + Monero miner in every investigated case; initial informational advisory 2026-08-07 escalated 2026-08-12 after public PoC appeared	Yes
2	Microsoft Threat Intelligence (quoted via The Hacker News, 2026-08-15)	Full payload chain: file/SSH-key transfer via Screen Sharing → SSH persistence → history/log clearing → pf modification → XMRig 6.26.0 as hidden .config/sysmond, ad-hoc signed, masquerading as com.apple.airportd, KeepAlive LaunchDaemon; exploitation confirmed ongoing as of 2026-08-18	Yes
2	Huntress technical blog	Root cause detail: SRP frame-length validator returns stale success status; SSFileCopySender/SSFileCopyReceiver helpers carry kTCCServiceSystemPolicyAllFiles entitlement (bypasses TCC); ES event ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH with authentication_type: SRP as a native (non-Falcon) signal	Yes
3	The Hacker News (Ravie Lakshmanan, 2026-08-15)	Aggregation of Microsoft findings; researcher @osxreverser quote: ~40,000 internet-exposed Screen Sharing hosts, concentrated in U.S. residential IPs, some institutional/university hosts	Yes
3	SecurityWeek, Tom's Hardware, Help Net Security, Malwarebytes	Corroborating timeline (patch 8/6, NCSC-NL advisory 8/7→8/12, CISA rescore 8/14, KEV add 8/18), public PoC availability, consumer remediation guidance	Partial

Web-hunter decision: no atomic file hash, C2/mining-pool domain, or wallet address has been publicly disclosed by any source reviewed as of this pack's build date. The Consolidated IOC Table and Falcon IOC CSV below ship confirmed behavioral indicators (file path, masqueraded bundle ID, miner version) and use explicit REPLACE_WITH_ placeholders for the undisclosed atomic fields rather than inventing values — see §10.

Eight hunt hypotheses were mapped from the attack chain below, ordered high-to-low fidelity. Hypotheses 1–4 (screensharingd process-tree anomaly, privileged file-copy helper abuse, hidden-binary execution, bundle masquerade) have no legitimate benign equivalent and carry CONF HIGH. Hypotheses 5–8 (persistence, pf/log tampering, mining network egress) are individually higher-FP but strong in combination or when correlated to a recent screensharingd session.

#	Step	Telemetry	Hunt Angle
1	Recon for internet-exposed port 5900 (Screen Sharing/VNC)	Perimeter/NGFW logs, external ASM scan, NetworkListenIP4	Exposure hunt — find it before the attacker does
2	Pre-auth connect exploiting SRP frame-length validator stale-success bug — auth bypassed, no valid credential presented	macOS unified log (ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH, authentication_type: SRP) — not visible to Falcon natively	Native audit-log hunt only — see §7; this is the pack's confirmed detection gap
3	Attacker drives SSFileCopySender/SSFileCopyReceiver (entitled kTCCServiceSystemPolicyAllFiles) for arbitrary root file read/write, bypassing TCC	ProcessRollup2/SyntheticProcessRollup2	Q1, Q2 — screensharingd child-process anomaly + root-context helper invocation
4	SSH public key + scripts transferred via Screen Sharing file transfer; SSH persistence established	ProcessRollup2; native authorized_keys audit	Native audit-log hunt §7; correlate with Q1/Q2 timing
5	XMRig 6.26.0 dropped, ad-hoc signed, hidden at .config/sysmond, masquerading as com.apple.airportd	ProcessRollup2, NewExecutableWritten	Q3, Q4 — hidden-path binary + bundle masquerade
6	Persistence via LaunchDaemon with KeepAlive	ProcessRollup2 (launchctl load/bootstrap)	Q5
7	pf (Packet Filter) rules modified; history and logs cleared to remove evidence	ProcessRollup2	Q6
8	Ongoing Monero mining — sustained CPU/GPU hijack, outbound stratum connections	NetworkConnectIP4 joined to ProcessRollup2	Q7

Type	Value	Confidence	Action	Context	Expiry
filename	sysmond	high	hunt	Hidden XMRig binary basename, dropped inside a .config/ directory (Microsoft-reported via The Hacker News)	2026-11-19
bundle-id (spoofed)	com.apple.airportd	high	hunt	Spoofed Apple system bundle identifier used to mask the XMRig process/LaunchDaemon	2026-11-19
software	XMRig 6.26.0	high	enrich	Cryptominer version dropped post-compromise (Microsoft-reported)	2026-11-19
process	SSFileCopySender / SSFileCopyReceiver	high	hunt	Legitimate Apple file-copy helpers, entitled kTCCServiceSystemPolicyAllFiles; abused for root file access (Huntress)	2026-11-19
port	5900/tcp	high	hunt	Screen Sharing/VNC service port; internet exposure is the precondition for exploitation	2027-02-19
sha256	REPLACE_WITH_SHA256	low	pivot	No file hash publicly disclosed as of pack build date — placeholder for Falcon-observed sample	2026-09-19
domain	REPLACE_WITH_MINING_POOL_DOMAIN	low	pivot	No mining-pool/C2 domain publicly disclosed as of pack build date	2026-09-19
ssh-key-fingerprint	REPLACE_WITH_SSH_KEY_FP	low	pivot	Attacker installs an SSH public key for persistence; no specific key material published	2026-09-19

No atomic hash, domain, or wallet address has been publicly attributed to this campaign as of the pack build date (2026-08-19). Ship the behavioral rows above for detection now; replace the placeholder rows the moment a corroborated atomic indicator is published or a sample is recovered in your own environment.

Surface	Required Telemetry	Priority	Gap Risk
macOS endpoint (Falcon sensor for Mac) — process/file/network	ProcessRollup2, SyntheticProcessRollup2, NewExecutableWritten, NetworkConnectIP4	Critical	Medium — covers post-compromise behavior; no native pre-auth SRP handshake visibility
macOS unified log (native, non-Falcon)	log show/log stream predicate on screensharingd, ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH	High	Low if forwarded to SIEM; High if not centrally collected
Network perimeter / NGFW / cloud security group	Inbound-connection logs on TCP/5900, NAT/port-forward rule inventory	Critical	High if perimeter logging/inventory is incomplete — this is the exposure precondition
MDM / fleet inventory (Jamf, Kandji, Addigy, etc.)	Screen Sharing / Remote Management enabled state, OS version/patch compliance	High	Medium — requires MDM query capability outside Falcon/CQL
SSH / identity	authorized_keys content audit, SSH login events	Medium	Medium — no dedicated Falcon macOS file-integrity event for this path; native audit only

Tactic	Technique ID	Technique Name	Observed Behavior
Initial Access	T1190	Exploit Public-Facing Application	Pre-auth SRP frame-length validator flaw in internet-exposed screensharingd (port 5900)
Initial Access	T1133	External Remote Services	Legitimate Screen Sharing / Remote Management feature exposed to the internet and abused as the entry vector
Privilege Escalation	T1068	Exploitation for Privilege Escalation	Entitled SSFileCopySender/SSFileCopyReceiver helpers grant root-level file read/write, bypassing TCC
Execution	T1059.004	Command and Scripting Interpreter: Unix Shell	Post-compromise shell commands for persistence setup, pf modification, log clearing
Persistence	T1543.004	Create or Modify System Process: Launch Daemon	KeepAlive LaunchDaemon installed to relaunch the hidden XMRig binary
Persistence	T1098.004	Account Manipulation: SSH Authorized Keys	Attacker-controlled SSH public key added for durable remote access
Defense Evasion	T1036.005	Masquerading: Match Legitimate Name or Location	XMRig binary named sysmond, hidden in .config/, bundle ID spoofed as com.apple.airportd
Defense Evasion	T1070.002 / T1070.003	Indicator Removal: Clear System/Command History Logs	Attacker clears shell history and system logs post-compromise
Defense Evasion	T1562.004	Impair Defenses: Disable or Modify System Firewall	Packet Filter (pf) rules modified to maintain access
Impact	T1496	Resource Hijacking	XMRig 6.26.0 Monero cryptominer runs persistently on the compromised host

These checks cover the pre-auth handshake and filesystem artifacts that Falcon's macOS sensor does not natively expose as queryable CQL fields. Run via SSH, Falcon RTR, or MDM script deployment.

1 · Confirm Screen Sharing exposure & patch level

sw_vers -productVersion
# Compare to patched: 14.8.9 (Sonoma) / 15.7.9 (Sequoia) / 26.6.1 (Tahoe)
sudo lsof -iTCP:5900 -sTCP:LISTEN
defaults read /Library/Preferences/com.apple.RemoteManagement.plist 2>/dev/null
sudo launchctl list | grep -i screensharing

2 · Unified log — screensharingd auth events

log show --predicate 'process == "screensharingd"' --style syslog --last 24h
log show --predicate 'eventMessage contains "SCREENSHARING_ATTACH"' --last 24h
# Look for authentication_type: SRP sessions with no corresponding valid-credential entry

3 · Hidden miner artifact sweep

sudo find / -iname "sysmond" 2>/dev/null
ls -la ~/.config/ 2>/dev/null
sudo launchctl list | grep -i airportd
plutil -p /Library/LaunchDaemons/*.plist 2>/dev/null | grep -i -B5 keepalive

4 · SSH authorized_keys audit

for u in /Users/*; do echo "== $u =="; sudo cat "$u/.ssh/authorized_keys" 2>/dev/null; done

5 · pf ruleset audit

sudo pfctl -sr
sudo pfctl -a '*' -s rules
# Compare against known-good baseline; flag any anchor not in change-control

6 · Log/history integrity check

ls -la ~/.bash_history ~/.zsh_history 2>/dev/null
log show --predicate 'eventMessage contains "log erase"' --last 7d

Q1, Q3, and Q4 have no legitimate benign equivalent and are strong Custom IOA candidates for prevent-mode or high-confidence alerting. Q2, Q5, Q6, and Q7 remain Investigate-only hunt queries until tuned against your environment's baseline.

IOA Name	Pattern	Exclusions	Deployment Path
DETECT — Screensharingd Anomalous Child Process	Parent = screensharingd; child ≠ SSFileCopySender/SSFileCopyReceiver	None known — start in Detect-only, promote to Prevent after a 14-day burn-in with zero benign hits	Custom IOA → Detect → 14-day validation → Prevent
DETECT — Hidden Binary at .config/sysmond	FileName matches ^sysmond$ AND ImageFileName contains .config/	None known	Custom IOA → Prevent (high confidence, no legitimate use case)
DETECT — airportd Bundle Masquerade	FileName matches ^airportd$ AND ImageFileName not under /System/Library/	None known	Custom IOA → Prevent

Gate	Requirement
Telemetry ready	Falcon sensor for Mac deployed and healthy on target fleet; macOS unified log forwarding configured for the native audit hunts in §7 (Falcon alone does not cover the pre-auth SRP handshake)
Benign baseline	Run Q1 and Q4 for a 14-day lookback with zero hits before promoting to Prevent; any hit during baseline must be triaged, not excluded blindly
Positive tests	Confirm Q1/Q2 fire against a controlled Screen Sharing file-transfer session in a lab; confirm Q3/Q4 fire against a benign process deliberately named/placed to match the pattern (do not test with live XMRig)
Promotion	Q1, Q3, Q4 → Custom IOA Prevent after burn-in (§9). Q2, Q5, Q6, Q7 remain Investigate-only until FP is tuned against your environment's actual admin/maintenance tooling

Playbook A — Emergency Patch + Disable Exposure

Step 1 — Verify current OS version

sw_vers -productVersion

Prerequisites: none. Reboot required: no. Rollback: none required (read-only check).

Step 2 — Apply the security update

softwareupdate -l
sudo softwareupdate -i "<update-label-from-list>" --restart

Prerequisites: admin credentials; network access to Apple software-update servers; typical combo-update free-space headroom (15+ GB recommended). Reboot required: yes — the update requires a restart. Rollback: none required — downgrading a security patch is not supported by Apple; if an incompatibility surfaces, pause further fleet rollout via MDM staged deployment rather than reverting the patched host.

Step 3 — Disable Screen Sharing / Remote Management if not required

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop
sudo launchctl disable system/com.apple.screensharing

Prerequisites: admin credentials; confirmed no legitimate remote-support workflow depends on the service. Reboot required: no. Rollback: sudo launchctl enable system/com.apple.screensharing, then re-enable via System Settings → General → Sharing → Screen Sharing.

Step 4 — Block inbound TCP/5900 at the perimeter

echo 'block in proto tcp from any to any port 5900' | sudo pfctl -a com.company/block5900 -f -
sudo pfctl -e

Prerequisites: pf available on the gateway/host; admin access; adjust the anchor name to your environment's convention. Reboot required: no. Rollback: sudo pfctl -a com.company/block5900 -F all to remove the anchor's rules; only run sudo pfctl -d if pf was disabled before this change.

Playbook B — Incident Triage: Confirm or Reject Compromise on a Suspect Host

Step 1 — Snapshot LaunchDaemons and compare to baseline

ls -la /Library/LaunchDaemons/ /Library/LaunchAgents/ ~/Library/LaunchAgents/ 2>/dev/null
plutil -p /Library/LaunchDaemons/*.plist 2>/dev/null | grep -i -B5 keepalive

Prerequisites: local/remote shell access (Falcon RTR or physical/SSH). Reboot required: no. Rollback: none required (read-only).

Step 2 — Search for the hidden miner artifact

sudo find / -iname "sysmond" 2>/dev/null
ls -la ~/.config/ 2>/dev/null

Prerequisites: shell access; may take several minutes on large volumes. Reboot required: no. Rollback: none required.

Step 3 — Inspect SSH authorized_keys for attacker-added entries

for u in /Users/*; do echo "== $u =="; sudo cat "$u/.ssh/authorized_keys" 2>/dev/null; done

Prerequisites: root/sudo. Reboot required: no. Rollback: none required (read-only) — if an unauthorized key is found, move to the Containment Runbook's eradication phase and preserve a copy as evidence before removing it.

Step 4 — Check pf ruleset for attacker-added anchors

sudo pfctl -sr
sudo pfctl -a '*' -s rules

Prerequisites: root/sudo. Reboot required: no. Rollback: none required (read-only).

Phase	Actions	Owner	Evidence
Isolate	Network-isolate the host via Falcon RTR containment; add a secondary block at the perimeter firewall in case containment is bypassed	SOC / IR	Isolation timestamp, Falcon containment confirmation
Eradicate	Capture a forensic triage collection (memory, relevant plists, logs) before deleting anything; kill the XMRig/sysmond/spoofed-airportd process; remove the KeepAlive LaunchDaemon plist; delete the hidden .config/sysmond binary; remove the attacker's SSH key from authorized_keys; revert pf ruleset to the known-good baseline; rotate local admin/service credentials on the host	IR / Endpoint Engineering	Pre-eradication forensic collection, list of removed artifacts, credential-rotation confirmation
Recover	Patch to the fixed macOS version; re-enable Screen Sharing only if required and only via VPN/Zero Trust — never direct internet exposure; restore from known-good backup or re-image if root access duration is unknown or extended	Endpoint Engineering / IT	sw_vers confirmation, clean post-remediation scan result
Post-incident	Review MDM inventory for other exposed Macs; enroll the fleet in continuous external-exposure monitoring; update detections/IOAs based on findings; brief stakeholders	SOC / IR Lead	After-action report, updated asset inventory

Technique	Behavior	CQL	IOA	Coverage
T1190 / CWE-287 — pre-auth SRP bypass itself	Stale-success frame-length validator accepts an unauthenticated Screen Sharing session	None — not exposed as a Falcon macOS field	None	GAP native audit-log hunt only (§7)
T1068 — privileged helper abuse	SSFileCopySender/Receiver root file access	Q1, Q2	Q1 candidate	Good
T1036.005 — masquerading	Hidden sysmond binary, spoofed airportd bundle	Q3, Q4	Q3, Q4 candidates	Good
T1543.004 — LaunchDaemon persistence	KeepAlive LaunchDaemon referencing hidden payload	Q5	Not yet (FP medium)	Partial
T1098.004 — SSH key persistence	Attacker SSH public key added to authorized_keys	None — no Falcon macOS file-write event confirmed for this path	None	GAP native audit-log hunt only (§7)
T1562.004 / T1070.002 / T1070.003 — defense evasion	pf modification, history/log clearing	Q6	Not yet (FP medium)	Partial
T1496 — resource hijacking	XMRig mining, outbound stratum connections	Q7	Not yet (FP high)	Partial

Two confirmed gaps remain: the pre-auth handshake itself and SSH-key persistence are only covered by the native, non-CQL audit hunts in §7 — Falcon's macOS sensor does not currently expose a queryable field for either. All CQL queries must clear the validation gates in §11 before promotion from Investigate-only to Custom IOA.

Tier	Source	Used For	Access Date
1	Apple — About the security content of macOS Sequoia 15.7.9	Official CVE-2026-65400 advisory text, discovery credit	2026-08-19
1	Apple — About the security content of macOS Tahoe 26.6.1	Confirms Aug 6 2026 advisory covers only CVE-2026-65400	2026-08-19
1	NVD — CVE-2026-65400	CVSS vector, CWE-287, CISA KEV dates, SSVC automatable rating	2026-08-19
1	NVD — CVE-2026-43760	Confirms July 27 2026 patch date, CVSS 8.6, distinct from 65400	2026-08-19
1	NVD — CVE-2026-43779	Confirms July 27 2026 patch date, CVSS 9.8, network interception logic issue	2026-08-19
1	NVD — CVE-2026-43777	Confirms July 27 2026 patch date, CVSS 7.5, remote DoS	2026-08-19
1	CISA — Adds Four Known Exploited Vulnerabilities to Catalog	KEV addition date, BOD 26-04 remediation requirement	2026-08-19
1	Bynario Atlas — discoverer's technical writeup	CVE-2026-43760 background, relationship to CVE-2026-65400	2026-08-19
2	The Hacker News — Apple macOS Screen Sharing Flaw Exploited to Install Monero Miner	Microsoft's full payload chain quote, exposure researcher stat	2026-08-19
2	Huntress — From Screen Share to Root Access	SRP root-cause detail, SSFileCopySender/Receiver entitlement, ES event names	2026-08-19
3	SecurityWeek — Recent macOS Screen Sharing Vulnerability Exploited in Attacks	NCSC-NL quote, public PoC timeline, exposure count	2026-08-19
3	Malwarebytes — Update your Mac	Consumer remediation guidance, exposure context	2026-08-19
3	Tom's Hardware — Critical macOS Screen Sharing flaw	Timeline corroboration (patch/NCSC-NL/CISA rescore)	2026-08-19
3	Help Net Security — Attackers exploit patched macOS Screen Sharing flaw	NCSC-NL advisory escalation timeline (Aug 7 → Aug 12)	2026-08-19