On August 6, Apple released security updates for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. The goal is to eliminate a macOS Screen Sharing vulnerability that allows an attacker on the network to access the screen sharing feature without needing valid login credentials.
Exploiting macOS Screen Sharing in Practice
Active exploitation of this flaw occurred on systems where port 5900 was accessible from the internet. According to information from macrumors.com, this happened in several cases recorded by the Netherlands National Cyber Security Centrum (NCSC-NL). The institution stated: "The Netherlands National Cyber Security Centrum has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet".
In these cases, attackers gained root access, representing the highest level of system administration. Subsequently, they installed a Monero cryptocurrency miner on the devices. Regarding these attacks, NCSC-NL noted: "In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed".
Critical Rating and Scope of the Problem
The US agency CISA initially rated the severity of this flaw at 7.1 out of 10, but later increased the rating to 9.8. According to the portal en.bloomingbit.io, Ryan Dowd from Huntress used the Censys platform to discover tens of thousands of potentially vulnerable devices. The screen sharing feature is disabled by default, but users often activate it to connect to Apple devices on remote servers.
Apple resolved the issue by implementing improved state management. According to pluang.com, it is recommended to update the system immediately and enable the screen sharing feature only when it is actually being used.