Apple has shared the security details behind today's macOS updates, confirming that all three releases patch a serious vulnerability in Screen Sharing. The company released macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 earlier today. The update notes for each version were brief, saying only that they included important security fixes and were recommended for all users. Now the full security content reveals a networking bug that could let an attacker bypass authentication and gain access to Screen Sharing without credentials.

Apple addresses Screen Sharing vulnerability

In a security advisory update, Apple described the flaw as an authentication issue in Screen Sharing. It affects macOS Tahoe, macOS Sequoia, and macOS Sonoma. The vulnerability is tracked as CVE-2026-65400 and was discovered and reported by Alfredo Pesoli, working with Bynario Atlas. According to Apple's advisory, an attacker on the network may be able to authenticate to Screen Sharing without valid credentials. The problem was addressed with improved state management.

Affected macOS versions and update builds

The patch is included in the following releases:

• macOS Sonoma 14.8.9
• macOS Sequoia 15.7.9
• macOS Tahoe 26.6.1

These are the current updates for the three most recent versions of macOS. Users on these builds should install the update as soon as possible. For those on older operating systems, Apple may not provide a patch, so upgrading to a supported release is the recommended course of action.

Why this vulnerability is serious

Screen Sharing is designed to require a username and password unless the host has selected options allowing guests. A bypass of that authentication check could allow an attacker who is already on the same network to initiate a Screen Sharing session without knowing any credentials. Once authenticated, the attacker can take over the user's desktop session or create a new one, depending on the macOS settings. That means they could view the screen, open applications, access files, copy data, or potentially perform administrative actions if the user has granted those permissions. In a worst-case scenario, this could lead to data exfiltration, malware installation, or broader compromise of the Mac.

What is Screen Sharing and how is it used?

Screen Sharing is a built-in macOS feature that lets users connect to another Mac remotely over a network or the internet. It is popular among IT administrators, remote workers, and users who need to access files or applications from another location. The tool relies on the Virtual Network Computing protocol and supports various authentication methods, including macOS user accounts and a dedicated VNC password. Because Screen Sharing can give a remote user full control of a machine, any vulnerability in its authentication mechanism is considered high risk. This is not the first time Apple has had to patch Screen Sharing; previous issues have included privilege escalation, denial of service, and authentication bypasses, but this one stands out because of how directly it affects network-facing services.

Network exposure and attack scenario

For an attacker to exploit this flaw, they need to be on the same network as the affected Mac. This could be a home Wi-Fi network, an office LAN, or a public Wi-Fi hotspot. In many real-world setups, Screen Sharing is not directly exposed to the internet, but an attacker who has already gained a foothold on the network can target the service. The lack of need for valid credentials makes this particularly attractive to attackers, since they do not have to guess passwords or use phishing techniques. They can simply scan the network for Macs with the Screen Sharing port open and launch an attack. The exact process is technical, but the result is that the attacker gains a remote session with the privileges associated with the logged-in user.

No known exploitation, but update immediately

Apple's advisory notes that there is no indication that the vulnerability was exploited in the wild. That is reassuring, but it does not reduce the need to update quickly. Attackers frequently reverse engineer security patches to identify the underlying flaws and develop exploits after patches are released. Once Apple published its security note, security researchers and attackers began comparing the old and new versions of the code. This means the window of opportunity for a potential attacker to target unpatched systems is open. Users who delay the update are essentially running a known vulnerable version of macOS with no protection against this attack.

Who should be most concerned

Anyone with a Mac is technically at risk, but the practical exposure depends on the environment. For a home Mac that sits behind a router and is not configured to accept incoming Screen Sharing connections, the attack surface is limited to other devices on the same local network. However, public Wi-Fi networks, office networks, and any situation where untrusted devices are connected to the same LAN make the risk greater. Network segmentation and firewall rules can help mitigate the impact, but they are not a substitute for installing the security update. In managed environments, IT teams should prioritize testing and deploying the patch across all macOS endpoints, especially laptops that frequently connect to various networks. Remote workers who use Screen Sharing to access office machines are also strongly encouraged to update both ends of the connection.

Immediate steps to take

The simplest protection is to install the update as soon

Source:9to5Mac News