Critical Pre-Auth RCE Flaw in macOS Screen Sharing (CVE-2026-65400) Allows Unauthenticated Root Takeover
Executive Summary
Apple has released emergency security updates across its supported desktop operating systems to address a maximum-severity, pre-authentication remote code execution (RCE) vulnerability in macOS Screen Sharing (Huntress Security Blog). Tracked as CVE-2026-65400, the flaw allows remote, unauthenticated attackers on the network to bypass the Secure Remote Password (SRP) authentication handshake completely, achieving arbitrary command execution as root (UID 0) without needing valid user credentials or system interaction.
Apple addresses the vulnerability in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Enterprise IT and cybersecurity teams managing Apple fleets are urged to apply these security updates immediately and audit all devices exposing Screen Sharing (VNC) or Remote Management (ARD) services over enterprise local networks or public gateways.
Deep-Dive Technical Analysis: Bypassing the Secure Remote Password Protocol
The Screen Sharing service in macOS relies on an extended Virtual Network Computing (VNC) server implementation (screensharingd), which utilizes Apple's custom implementation of the Secure Remote Password (SRP-6a) protocol for mutual authentication and session key exchange. SRP is designed to allow zero-knowledge authentication over untrusted networks without exposing plaintext password hashes across the wire.
As detailed in technical analysis by Huntress Labs, CVE-2026-65400 stems from an logic verification defect within screensharingd during the initial SRP key-exchange sequence:
1. Protocol Handshake Flaw: When an incoming client initiates a VNC session, screensharingd generates a public ephemeral key ($B$) and expects the client to respond with its public ephemeral key ($A$) and a proof-of-password hash ($M_1$).
2. Zero-Proof Logic Bypass: In affected macOS versions, submitting a specially crafted, out-of-bounds public key $A = 0 \pmod N$ (or a malformed SRP $M_1$ proof packet) forces the cryptographic session key calculation to evaluate to a deterministic zero value.
3. Authentication Bypassed: Due to improper return-code verification in screensharingd, the daemon misinterprets the resulting null key calculation as a successful authentication exchange. Instead of terminating the TCP socket with an Authentication Failed response, the service immediately transitions the connection into an authenticated administrative VNC/RFB session state.
4. Pre-Auth Root Execution: Because screensharingd runs under elevated root privileges to manage virtual displays, user switching, and keyboard/mouse event injection, bypassing authentication grants the remote attacker full root-level shell access over the VNC control protocol—all prior to any user login prompt.
Pre-Auth CVE-2026-65400 vs. Post-Auth CVE-2026-43760
To fully understand the risk landscape, security teams must distinguish CVE-2026-65400 from its sibling vulnerability, CVE-2026-43760:
Feature / Metric
CVE-2026-65400
CVE-2026-43760
Authentication Barrier
Pre-Authentication (Zero credentials required)
Post-Authentication (Requires valid user login)
CVSS v3.1 Score
9.8 (Critical)
7.8 (High)
Vulnerability Class
SRP Logic Verification / Authentication Bypass
Memory Corruption / Buffer Overflow
Attack Complexity
Low (Network accessible)
Low (Once authenticated)
Impact
Immediate Root RCE without user interaction
Local Privilege Escalation / Arbitrary Code Execution
Affected Daemon
screensharingd (Screen Sharing / VNC)
screensharingd / Remote Management subservices
While CVE-2026-43760 allowed an authenticated user with low-privilege VNC access to corrupt memory and escalate privileges to root, CVE-2026-65400 removes the authentication barrier entirely. Any unauthenticated network adversary capable of reaching port 5900 (or Apple Remote Management port 3283) on a vulnerable Mac can compromise the host instantly (Huntress Security Blog).
Enterprise Threat Landscape & Industry Impact
Enterprise adoption of macOS across engineering, executive, and creative departments has grown significantly, making macOS endpoint fleets high-priority targets for corporate espionage and ransomware operators.
In enterprise environments, Screen Sharing and Apple Remote Management (ARD) are frequently enabled for remote IT support, helpdesk troubleshooting, and multi-user Mac build agents. When these services are exposed to internal corporate Wi-Fi segments, VPN subnet ranges, or misconfigured port-forwarded routers, CVE-2026-65400 becomes an ideal lateral movement and initial access vector:
* Wormable Lateral Movement: Threat actors inside a compromised corporate network can scan local subnets for open VNC (port 5900) services, automatically exploit screensharingd, and deploy rootkits or credential harvest tools across all vulnerable Mac workstations in minutes.
* Helpdesk & Remote Worker Risk: Laptops connecting via split-tunnel VPNs or un-segmented home/hotel Wi-Fi networks are vulnerable to local network interception and rapid compromise.
* Build Server Pipeline Exposure: macOS build farms used for iOS and macOS app compilation often keep Screen Sharing active, providing attackers an avenue to hijack software signing keys and poison software supply chains.
Actionable Remediation & Defense Playbook
Security administrators and Mac fleet managers should execute the following defense plan immediately:
1. Apply Official macOS Security Updates
Deploy Apple's patched OS builds across all fleet assets (Huntress Security Blog):
* macOS Tahoe: Upgrade to 26.6.1 or later.
* macOS Sequoia: Upgrade to 15.7.9 or later.
* macOS Sonoma: Upgrade to 14.8.9 or later.
2. Disable Screen Sharing & Remote Management
If Screen Sharing or Apple Remote Management is not strictly required for daily operations, disable them immediately via MDM or System Settings:
* System Settings: Navigate to System Settings -> General -> Sharing and toggle off Screen Sharing and Remote Management.
* MDM Configuration Profiles: Enforce restriction payloads disabling com.apple.screensharing and com.apple.RemoteDesktop.
3. Restrict Network Access & Enforce ZTNA / VPN
* Firewall Isolation: Block incoming traffic on TCP Port 5900 (VNC) and TCP/UDP Port 3283 (ARD) at the network perimeter and internal VLAN boundaries.
* Zero Trust Access: Never expose Screen Sharing ports directly to the internet. Enforce Zero Trust Network Access (ZTNA) or full-tunnel VPN with mutual TLS and device health checks for all remote administration.
4. Perform Network Threat Hunting
Audit corporate networks for active exploitation attempts:
* Scan endpoint logs (/var/log/system.log and Unified Logs) for screensharingd connection attempts originating from unexpected internal or external IP addresses.
* Inspect host processes for anomalous child processes spawned by /System/Library/CoreServices/RemoteManagement/ScreensharingAgent.app/Contents/MacOS/screensharingd.
For detailed technical research and updates, read the full analysis on the Huntress Security Blog.