Attackers are targeting systems that expose port 5900 to the Internet.
Tracked as CVE-2026-65400, the vulnerability has a CVSS severity score of 7.1 out of 10
Apple recently released patches for a macOS Screen Sharing vulnerability across macOS Tahoe, Sequoia, and Sonoma, and now the same fix is reportedly being targeted by attackers. Dutch authorities have warned that a vulnerability, tracked as CVE-2026-65400, could allow attackers to execute malicious code on affected Mac models. The vulnerability is rated 7.1 out of 10 in severity. It is linked to the operating system's Screen Sharing functionality, and it allows a user to view a Mac's display and control its keyboard and mouse.
First reported by Arstechnica, Dutch officials have warned that a macOS vulnerability that allows attackers to execute malicious code is actively exploited. “The NCSC has received a report indicating that active exploitation of this vulnerability has been observed on multiple systems where port 5900 was accessible from the internet" said the Netherlands National Cyber Security Centre (NCSC). In the affected cases, attackers reportedly gained root access and placed a Monero crypto miner.
The flaw, which is tracked as CVE-2026-65400, carries a CVSS severity score of 7.1 out of 10. It is linked to a flaw in macOS screen sharing that allows users to see a Mac's display and control its keyboard and mouse while the machine is turned on. Apple patched this vulnerability earlier this month for macOS Tahoe, Sequoia, and Sonoma.
NCSC states that the attacks depend on port 5900 being reachable from the internet. When Screen Sharing is enabled, macOS can open this port through its firewall settings.
macOS users are advised to keep Screen Sharing disabled when it is not needed to ensure safety. It can be done by heading to System Settings > General > Sharing and switching off Screen Sharing. Users are also recommended to install Apple's latest security updates for their respective versions of macOS.
Apple offered a patch for this macOS Screen Sharing flaw earlier this month in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.
Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.