macOS Screen Sharing Vulnerability Exploited in the Wild

A security flaw in Apple’s macOS Screen Sharing feature has been actively exploited by attackers, according to the Netherlands’ National Cyber Security Centre (NCSC-NL). The vulnerability, which could allow unauthorized remote access to a Mac, was patched by Apple earlier this month.

Details of the Vulnerability

The flaw permitted an attacker to authenticate to the Screen Sharing service without valid credentials, potentially granting remote access to a user's system. Apple addressed the issue in macOS Tahoe 26.6.1, released on August 6, alongside updates for macOS Sonoma 14.8.9 and macOS Sequoia 15.7.9. The company stated that the update improved state management to resolve the authentication problem.

Observed Attacks and Impact

NCSC-NL reported that the vulnerability was being exploited on multiple systems where port 5900 was exposed to the internet. This port is commonly used for remote desktop and screen-sharing services, and macOS may intentionally open it through the firewall when Screen Sharing is enabled. In the observed incidents, attackers gained root access to affected Macs and installed a Monero cryptocurrency miner, leveraging the compromised machines' computing resources for mining activities. This highlights the significant risks of leaving remote-access services directly accessible online.

Recommendations and Mitigation

Apple has urged users who have not yet installed the latest security updates to do so immediately. The company also recommends using a VPN when Screen Sharing is enabled to add an extra layer of protection against internet-based attacks. Mac users can verify their system is up to date by navigating to System Settings → General → Software Update. Given that the vulnerability affects multiple versions of macOS, it is especially critical for users with Screen Sharing enabled or those whose Macs may be reachable from the internet to apply the patches promptly.

#Apple, #macOS, #Cybersecurity, #ScreenSharing, #SecurityUpdate