Apple has published the security details for the latest macOS updates, confirming that macOS Tahoe, Sequoia, and Sonoma all address a serious vulnerability in Screen Sharing. The flaw could allow an attacker on the same network to authenticate to Screen Sharing without valid credentials. The patches arrive as part of today’s macOS releases and are being recommended for all users.
What Apple fixed in the Screen Sharing update
Earlier today, Apple released macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1. The release notes for all three versions were brief, stating only that they contained important security fixes and were recommended for all users. Now, Apple has updated its security releases page with the specifics of the vulnerability.
Across all three versions of macOS, Apple fixed a bug in Screen Sharing that could allow an attacker on the network to authenticate without valid credentials. The security note describes the impact as: “An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.” The description adds that an authentication issue was addressed with improved state management.
The vulnerability is tracked as CVE-2026-65400 and was credited to Alfredo Pesoli, also known by the handle @__rev. The discovery was made through Bynario Atlas, a security research initiative by Bynario. Apple’s note does not include any indication that the vulnerability was exploited in the wild, but the severity of the issue has still prompted urgent patches across multiple operating system versions.
Why this Screen Sharing vulnerability is serious
Screen Sharing is a built-in feature in macOS that allows users to remotely view and control another Mac. It is commonly used by system administrators, support teams, and users who need to access their own machines from another location. Because the feature is designed to provide remote control capabilities, any authentication bypass can have significant consequences.
If an attacker successfully exploits this vulnerability, they may be able to gain access to the Screen Sharing session of a vulnerable Mac without needing a password or any other form of valid credentials. Depending on how the Mac is configured and what privileges are granted to the session, the attacker could potentially view the screen, open applications and files, modify settings, or take other actions on the system.
This type of attack requires the attacker to be on the same network as the target Mac. That means it could be exploited by someone on the same Wi-Fi network, a malicious actor inside an office network, or an attacker who has already gained a foothold on another device connected to the network. While the attack is not remotely exploitable from the internet by default, the risk is still significant in environments with untrusted users or devices.
Screen Sharing’s role in macOS
Screen Sharing has been a part of macOS for many years, evolving from the earlier Apple Remote Desktop protocol. It is built on the VNC protocol and is tightly integrated with the operating system. The feature is designed to make it easy for users to connect to other Macs using the Finder or the dedicated Screen Sharing application.
Over the years, Apple has added various security protections to Screen Sharing, including encryption options, integration with the macOS user authentication system, and controls that allow administrators to limit who can connect. However, features that combine network accessibility with remote control are always an attractive target for attackers. This vulnerability shows that even well-established features can contain subtle authentication flaws.
On many Macs, Screen Sharing is not enabled by default, but it is commonly turned on for remote administration, technical support, or collaboration. Some users also enable it so they can access their home Mac from work or while traveling. In all of these scenarios, the feature will listen for incoming network connections, which makes the latest patch especially relevant.
Apple’s rapid response and update strategy
One notable aspect of this security update is that Apple chose to release patches for three different versions of macOS at the same time. This is consistent with Apple’s recent practice of supporting multiple operating system generations with security updates. Instead of waiting for the next major feature release, Apple regularly ships point releases that address vulnerabilities as soon as the fixes are ready.
The fact that the updates were released without prior beta testing indicates that Apple viewed the vulnerability as urgent. Security patches that are pushed directly to users outside of the usual beta cycle are often reserved for actively exploited flaws or vulnerabilities that could be easily leveraged by attackers. In this case, there is no evidence of active exploitation, but the potential for unauthorised network access is serious enough that Apple did not want to delay the fix.
Apple’s security release notes have become an important source of information for both users and security professionals. They provide details about the affected components, the type of impact, and the CVE identifiers associated with each vulnerability. This transparency helps organizations assess the risk and prioritise their patching efforts.
What users should do now
Even if you do not use Screen Sharing, Apple recommends installing the latest updates as soon as possible. The update is available through System Settings, under General, then Software Update. Users running macOS Sonoma should see version 14.8.9, macOS Sequoia users should see version 15.7.9, and macOS Tahoe users should see version 26.6.1.
Before installing the update, it is always a good idea to back up your Mac. A Time Machine backup or another backup solution can protect against unexpected issues during installation. Once the backup is complete, you can download and install the update, which will likely require a restart.
Users who are managing multiple Macs in a business or school environment should coordinate with their IT team to ensure that all devices are updated quickly. In larger organizations, patch management tools can help automate the process and verify that every Mac is running a patched version of the operating system.
For those who are particularly concerned about exposure, it is also worth reviewing whether Screen Sharing needs to be enabled at all. If you do not use remote screen sharing, turning off the feature can reduce the attack surface. On macOS, you can check whether Screen Sharing is enabled by going to System Settings, then General, then Sharing. If it is on and you do not need it, turning it off is a simple and effective security measure.
Protecting against network-level attacks
This vulnerability is a reminder that operating systems can have flaws in services that are exposed to the network. Even when a Mac is protected by a firewall, certain services may be available on local networks. Attackers who are already on the same network are often able to discover and target devices more easily than remote attackers.
To reduce the risk of network-based attacks, users should consider using a firewall, keeping operating system and application software up to date, and avoiding untrusted Wi-Fi networks without a VPN. For organizations, segmenting networks and monitoring for unusual connection attempts can help detect potential intrusions. Administrators should also ensure that Screen Sharing sessions are protected with strong user credentials and, where possible, restricted to specific users or groups.
Apple’s patch addresses the authentication bypass at the system level, but ongoing vigilance is still important. Software vulnerabilities are discovered continuously, and regular updates remain one of the best defenses against attackers. The absence of known exploitation is reassuring, but it does not change the fact that this was a serious issue.
Looking at the broader security landscape
This is far from the first time Apple has had to patch a flaw in a remote-access feature. In recent years, macOS has seen vulnerabilities in networking components, file sharing, and other services that are exposed to network connections. Each fix is an important reminder that security is an ongoing process, not a one-time achievement.
The discovery of CVE-2026-65400 by an external researcher also highlights the value of coordinated vulnerability disclosure. Researchers who discover flaws and report them to Apple give the company an opportunity to develop and test a solution before public details are released. This process helps protect users by allowing patches to be shipped before attackers can take advantage of the information.
As with any security update, the best course of action is to install it without delay. The update is free and available from Apple’s Software Update mechanism. Users who have automatic updates enabled will likely receive the patch automatically, but manual installation is still available for those who prefer to control the timing.
Apple has not stated whether it plans to release any additional security updates in the coming weeks, but the company typically continues to patch macOS on a regular schedule. In the meantime, users should verify that their Mac is running the latest version and take advantage of the protections offered by the new software.
Source: 9to5Mac News