Apple Ships Screen Sharing Fix for Pre-Auth Mac Attacks

Apple released a security update for Macs addressing a Screen Sharing flaw that could let a network attacker authenticate without valid credentials. The patch ships in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9, less than two weeks after the prior round of fixes alongside iOS 26.6 in late July. Tracked as CVE-2026-65400, the authentication issue was resolved with improved state management, according to Apple's support page.

The latest bug follows CVE-2026-43760, a Screen Sharing issue patched in the previous update cycle. Huntress principal security operations center analyst Ryan Dowd said CVE-2026-65400 is the more serious of the two. It exploits a flaw in the Screen Sharing service's implementation of Secure Remote Password, which Dowd said "ultimately allows pre-authenticated remote code execution on all supported macOS versions." An attacker could run malicious code on the victim system without logging in as root.

Dowd wrote that anyone using Screen Sharing on a supported macOS version needs to "apply the most recent security updates immediately." Apple posted a more detailed analysis on its website.

The Mac updates arrive as Apple prepares iOS 26.6.1 for release, according to MacRumors. With iOS 27 due in September and AI accelerating bug hunting, Apple has been keeping up with fixes in its older software. Users can check for the update by going to General > Settings > Software Update.

Apple's patch cadence has picked up as researchers find more vulnerabilities in older code. For Mac owners who rely on Screen Sharing for remote access, the fix closes a hole that required no credentials to exploit.