Vulnerability giving attackers full control of Macs is under active exploitation

The Dutch National Cyber Security Centrum has confirmed what security researchers suspected: the macOS screen-sharing flaw is not theoretical. Attackers are already using it to gain root access and install Monero miners on machines with port 5900 exposed. The warning is precise, and the exploitation is real.

Apple patched CVE-2026-65400 last week across macOS Tahoe, Sequoia, and Sonoma. The severity rating of 7.1 out of 10 undersells the practical danger. This is not a bug that requires social engineering or a malicious file. It is a direct path to full control of a Mac, provided the screen-sharing service is reachable from the internet.

The root cause is a state management flaw in the screen-sharing capability. That is a quiet way of saying the system fails to properly track who is connecting and under what conditions. An attacker can bypass authentication entirely, log in without a password, and take over the keyboard and mouse. The Monero miner is just the payload of choice in these observed cases; the access itself is the real commodity.

For remote workers, the connection is uncomfortable. Screen sharing is a standard tool for IT support and collaboration, and many laptops have it enabled by default or left on after a troubleshooting session. The NCSC's warning specifically notes that exploitation occurred on systems where port 5900 was accessible from the internet. That means the machines were not behind a firewall or VPN, a configuration that is all too common for home offices and small businesses.

The lesson is not to abandon remote access tools. It is to audit them. Check whether screen sharing is enabled, confirm that port 5900 is not exposed, and apply the patch immediately. The attackers are not waiting for a convenient time to strike; they are scanning for open ports right now. The Dutch warning is a reminder that the gap between a patch and a compromise is measured in hours, not weeks.