Technology and Science14 August, 20262 min read
Dutch Officials Warn CVE-2026-65400 Lets Attackers Take Control of Macs, Install Monero Miners
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Dutch officials warn CVE-2026-65400 enables remote code execution via macOS Screen Sharing. Attackers actively exploit the flaw, exploiting internet-exposed port 5900.
CVE-2026-65400 exploited
Dutch officials have issued a warning about a high-severity macOS vulnerability, CVE-2026-65400, that is being actively exploited by attackers. The flaw stems from a bug in macOS Screen Sharing capability and can allow remote attackers to gain control of a Mac if port 5900 is accessible from the internet.
Ars Technica reports that the Netherlands National Cyber Security Centrum observed attackers accessing root privileges and installing Monero crypto miners on affected systems. Apple released a patch for macOS Tahoe, Sequoia, and Sonoma last week, and the vulnerability carries a severity rating of 7.1 out of 10.
Root access and miner
The Netherlands’ National Cyber Security Centre said it received a report that the vulnerability is being exploited in the wild in attacks where port 5900 is exposed to the internet. BleepingComputer reports that “The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” and that in all these cases root had been accessed and a Monero crypto miner had been placed.
Ars Technica adds that the vulnerability allows a remote party to view the screen and control the keyboard and mouse while a machine is turned on. Apple’s disclosure, as quoted by Ars Technica, said CVE-2026-65400 “may” allow an attacker without credentials to gain access to a Mac.
Patching and exposure risk
BleepingComputer says Apple fixed CVE-2026-65400 on August 6 in macOS Tahoe 26.6.1 and earlier releases, and it lists upgrades including macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Where updates are not immediately possible, BleepingComputer recommends disabling Screen Sharing via System Settings (General → Sharing → Screen Sharing) if it is not needed.
SC Media advises users to disable screen sharing when not in use and ensure port 5900 is not exposed to the internet, recommending VPN or SSH tunneling as safer alternatives. The broader risk is that, while current exploits focus on crypto mining, there is a significant risk attackers could leverage the vulnerability to deploy malware for credential theft or other malicious activities.