What happened
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
Affected versions
macOS: before 14.8.9 (custom); before 15.7.9 (custom); before 26.6.1 (custom); before 26.7 (custom); before 27 (custom) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
RepositoryAuthorFirst seenReference
CVE-Intel · HORKimhab/CVE-2026-65400CVE-2026-65400ExploitPython★ 3⑂ 1Code indexedUpdated 26 Aug 2026HORKimhab2026-08-18CandidateCVE-Intel · panchocosil/CVE-2026-65400-pocRead-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.BypassPython★ 3⑂ 0Code indexedUpdated 25 Aug 2026Tags: apple, cve-2026-65400, exploit, macos, poc, screen-sharing, security-research, vulnerability-researchpanchocosil2026-08-21CandidateCVE-Intel · acheong08/CVE-2026-65400Apple MacOS Screen Sharing Arbitrary File read/write -> RCERCEPython★ 2⑂ 1Code indexedUpdated 22 Aug 2026acheong082026-08-22CandidateSource timeline
CVE record published by NVDView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.