The tech giant explained the changes were related to an authentication issue, ‘fixing state management to ensure credentials are properly validated.’
The vulnerability was discovered by security researcher Alfredo Pesoli of Bynario. According to the NCSC-NL, there are currently reports of bad actors actively using this exploit. ‘Multiple systems with port 5900 open to the internet,’ the Netherlands-based watchdog stated in a report this week, ‘were compromised using this vulnerability.’
In all cases of exploitation detected so far, the attackers gained root access to the targeted systems and deployed a Monero cryptocurrency miner. It remains unclear how long the threat landscape had been targeting macOS Screen Sharing, how many systems had been impacted, and whether the mining activity was the sole motive behind the attacks.
Several other flaws impacting the macOS Screen Sharing component have also been detected.
They include CVE-2026-43760 which can lead to the disclosure of sensitive information, arbitrary file creation, and remote code execution under specific conditions; CVE-2026-43777, which may result in a denial-of-service scenario; and CVE-2026-43779 with a logic flaw that can cause applications to hijack connections from other processes.
According to Pesoli’s research, there are additional privilege escalation possibilities in an older authentication method used by Screen Sharing, including VNC passwords.
A threat actor with the VNC password could potentially access protected files or create new files with root permissions, resulting in remote code execution.
The researcher also highlighted a pre-authentication vulnerability in the Screen Sharing daemon which, if successfully exploited, would allow an attacker to compromise a Mac with Screen Sharing enabled and without requiring a VNC password. ‘All the attacker needed was a target IP address,’ he added.
His findings suggest that tens of thousands of Screen Sharing services were exposed to the internet, putting residential users, educational institutions, and corporations at risk. Researchers advise that Screen Sharing should not be exposed to the internet and recommend that such services be placed behind an IPsec or other secure access gateway.
It is unclear how many macOS users had their systems compromised via the Screen Sharing flaw.
However, cybersecurity analysts warn that AI-powered tools are facilitating faster threat modeling and detection, enabling attackers to exploit vulnerabilities almost immediately after they become publicly known.
‘We had an AI agent that helped us develop working exploits for two of the Screen Sharing vulnerabilities within hours of their disclosure,’ Calif, a security company, noted in a report.
macOS users must install the latest software updates released by Apple to ensure their systems are protected against the newly discovered flaws.
Customers who cannot immediately install the critical security patches should disable Screen Sharing in their Mac’s Sharing preferences until the updates are deployed.
