CVE-2026-65400: macOS Screen Sharing Authentication Bypass (KEV)

CVE-2026-65400 is an authentication state-management flaw in macOS's Screen Sharing service that lets an attacker on the network authenticate without valid credentials and reach the remote-desktop session, fixed in macOS Sonoma 14.8.9, Sequoia 15.7.9 and Tahoe 26.6.1/26.7; it is in the CISA KEV catalog, but Apple's own advisory text does not itself claim evidence of in-the-wild exploitation.

CVE-2026-65400 is an improper authentication vulnerability (CWE-287) in macOS. NVD's description, taken from Apple's own advisory text, states: "An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials" (NVD).

Apple's own support-page advisories for this fix (filed under separate HT numbers per macOS version) confirm the affected component is Screen Sharing, that the flaw involved improved state management around authentication, and credit the discovery to researcher Alfredo Pesoli (@__rev) via Bynario Atlas; none of the Apple advisory pages fetched for this entry state that the issue was found through, or has evidence of, exploitation in the wild (Apple Security Advisory HT148170).

NVD's only CVSS metric on record is a CISA-ADP Secondary score of CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; NVD's vulnStatus is "Analyzed" but no independent NVD Primary metric has been published, so the 9.8 figure is CISA-ADP's assessment, not NVD-confirmed (NVD).

CISA added CVE-2026-65400 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-18, with a required-action due date of 2026-08-21 under Binding Operational Directive 26-04, flags "Forensics Triage Requirements" as Yes, and lists known ransomware campaign use as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed). Notably, CISA's own KEV listing criteria require confirmed evidence of exploitation before an entry is added, even though Apple's public advisory text — characteristically terse, as with most Apple security notes — does not itself describe an in-the-wild attack; readers should treat the KEV listing, not the vendor advisory wording, as the operative evidence of active exploitation here (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.01723 (77.45th percentile) — elevated for a flaw requiring network access to the Screen Sharing service specifically, but below the levels seen for internet-facing, unauthenticated-RCE KEV entries on this site (FIRST EPSS).

Any Mac running macOS Sonoma before 14.8.9, Sequoia before 15.7.9, or Tahoe before 26.6.1 should be updated immediately, and Screen Sharing should be disabled on any Mac where it is not actively required, particularly on networks an attacker could reach.

• An authentication issue in Screen Sharing, addressed with improved state management, let an attacker on the network authenticate without valid credentials; fixed in macOS Sonoma 14.8.9, Sequoia 15.7.9, Tahoe 26.6.1/26.7 and Golden Gate 27. — NVD
• Apple's advisory pages for this fix confirm the Screen Sharing component and credit researcher Alfredo Pesoli (@__rev) via Bynario Atlas, without describing exploitation in the wild. — Apple Security Advisory HT148170
• CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, submitted by CISA-ADP as a Secondary score; NVD has not published its own Primary metric. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-18, due date 2026-08-21, forensic triage flagged Yes, known ransomware campaign use listed as Unknown; confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
• EPSS score is 0.01723 (77.45th percentile) as of 2026-10-29. — FIRST EPSS