SAN FRANCISCO — The Netherlands National Cyber Security Centrum confirmed this week that attackers are actively exploiting a high-severity macOS flaw on machines with port 5900 open to the internet. In every confirmed incident, the attacker gained root access and installed software that mines Monero cryptocurrency using the machine's own computing resources.
The flaw is tracked as CVE-2026-65400 and carries a severity score of 7.1 out of 10. Apple issued a patch last week covering three macOS versions: Tahoe, Sequoia and Sonoma. Details of the vulnerability became public at the Black Hat security conference, also last week, compressing the window between disclosure and live exploitation to days.
The vulnerability lives inside macOS's screen sharing feature — the built-in capability that lets a remote party see a Mac's display and operate its keyboard and mouse. The defect is in state management, the component that tracks prior user interactions, session variables and system conditions. A flaw there lets an unauthenticated remote party bypass credential checks entirely and take control.
Port 5900 is the network port macOS opens when screen sharing is turned on. The NCSC's warning is specific: exploitation requires that port to be reachable from the internet. Most home and business routers block 5900 by default, but any configuration that forwards or exposes that port — intentional or accidental — puts the machine in scope.
Apple's disclosure said the flaw "may" allow an unauthenticated attacker to gain access. That hedged language is standard practice among software vendors at disclosure time and does not change the operational picture: Dutch authorities have observed confirmed root-level access on multiple systems.
The payload deployed so far is a Monero miner. Monero is a privacy-focused cryptocurrency designed to obscure transaction trails, which makes it a persistent favorite for unauthorized mining operations — the attacker collects the mined coins with little traceability. The miner runs silently, consuming CPU cycles without displaying any visible process to the Mac's owner.
Root access, however, is the more consequential fact than the miner itself. An attacker with root on a machine can read any file, install any software, modify system logs to erase their tracks or establish persistent backdoors. The current Monero-miner payload represents the floor of what this access enables, not the ceiling.
Security practitioners have long advised against exposing port 5900 directly to the internet even under normal conditions. The standard alternative is to tunnel screen sharing traffic through a VPN or SSH connection, which keeps 5900 off the public internet entirely. Both methods require configuration steps beyond what most non-technical users can execute without assistance, which is why exposed port 5900 instances remain common.
For users who need screen sharing, practical guidance breaks into three steps. First, disable the feature when it is not actively in use — System Settings, then General, then Sharing, where a toggle controls screen sharing on and off. Second, install Apple's security update from last week immediately. Third, check router and firewall settings to confirm port 5900 is not forwarded or exposed externally. Users who have never configured port forwarding are likely protected at the network perimeter, but the machine-level patch remains necessary regardless.
The Black Hat disclosure timeline is worth noting. Security conferences publish vulnerability details to force vendors to patch and to educate defenders, but the same information reaches attackers simultaneously. The gap between Black Hat disclosure and observed exploitation in this case was narrow enough that defenders who did not patch within days of the conference were already running behind active attack activity.
Apple's patch covers all three currently supported macOS versions. Users running older, unsupported releases have no official fix available and remain exposed regardless of port configuration. The company has not published a timeline for any out-of-band patch for unsupported versions.
