Critical macOS Vulnerability Allows Full System Takeover
Dutch authorities warn of actively exploited flaw enabling remote attackers to execute malicious code on Macs.
1Active Exploits Detected
The Dutch National Cyber Security Centre (NCSC) has reported active exploitation of a high-severity vulnerability in macOS. Multiple systems with port 5900 accessible from the internet were compromised. Attackers gained root access and installed Monero cryptocurrency mining software. These incidents demonstrate the severity and widespread nature of this vulnerability, which allows complete system takeover and malicious code execution.
2Technical Details of the Flaw
Tracked as CVE-2026-65400, this vulnerability stems from a bug in macOS's screen sharing feature, rated 7.1/10 in severity. The flaw enables remote attackers to view screens and control keyboards/mice when machines are powered on. The root cause lies in a 'state management' defect that fails to properly track system states. Apple released patches last week for macOS Tahoe, Sequoia, and Sonoma to address this critical security issue.
3Potential Attack Impacts
This vulnerability is particularly dangerous as it grants attackers full system control. With root access, hackers can execute arbitrary code, steal data, or turn systems into malware distribution points. The installation of Monero miners indicates financial motives behind these attacks. In corporate networks, such breaches could lead to larger-scale security incidents, data leaks, or network-wide compromises.
4Apple's Response and Patch
Apple released security updates last week addressing this vulnerability in macOS Tahoe, Sequoia, and Sonoma. However, the patch adoption rate remains unknown. Security experts strongly recommend immediate updates, especially for users employing screen sharing features. Systems with internet-accessible screen sharing face the highest risk. Organizations should prioritize updating all affected macOS devices in their networks.
5Screen Sharing Risks
The vulnerability exists in macOS's built-in screen sharing functionality, normally used for remote viewing and control. The state management flaw allows unauthorized access bypassing security checks. Users should verify screen sharing settings in System Preferences and disable the feature if unused. Enterprise Mac administrators should carefully manage this setting across all devices, restricting access to trusted networks only.
6Cryptocurrency Mining Connection
NCSC's investigation revealed Monero cryptocurrency miners being deployed in compromised systems. Monero's privacy features make mining activities difficult to trace. Such attacks hijack system resources for financial gain, potentially causing hardware damage from excessive CPU usage and significantly degrading system performance. The miners' presence often indicates initial access for more severe follow-up attacks.
7Enterprise Network Dangers
This vulnerability poses significant risks for corporate environments with multiple Macs. A single compromised device could serve as an entry point for network-wide attacks. IT administrators must urgently update all macOS devices and review network monitoring systems for abnormal activities. Basic precautions include ensuring port 5900 isn't internet-accessible and implementing strict access controls for remote management features.
8Critical User Recommendations
Security professionals urge all macOS users to immediately install the latest updates. Disable screen sharing if unused, and verify port 5900 accessibility. Network administrators should scan for suspicious activities or abnormal CPU usage. This incident underscores the importance of cybersecurity awareness and proactive measures, particularly for internet-facing systems and enterprise networks with multiple endpoints.