Apple has patched a critical improper authentication flaw (CVSS 9.8) that, per Apple's advisory, may allow an attacker on the network to authenticate to macOS Screen Sharing without valid credentials, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18.
What Is It
CVE-2026-65400 is an authentication issue in macOS that Apple describes as "addressed with improved state management." Per Apple's advisory, an attacker on the network may be able to authenticate to Screen Sharing without valid credentials. It is classified as CWE-287 (Improper Authentication).
The CVSS v3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact.
Why It Matters
CISA added the CVE to the KEV catalog on 2026-08-18, and the SSVC decision data from the CISA Coordinator lists exploitation as active, automatable as yes, and technical impact as total. Known ransomware campaign use is listed as Unknown.
The combination of an unauthenticated network path into Screen Sharing and a "total" technical impact suggests that a successful attacker could obtain interactive access to the host, though neither Apple nor CISA has published details of post-exploitation behavior. The automatable rating indicates the attack can be scripted at scale.
What's Vulnerable
Apple macOS, in the following version ranges:
- macOS 14.0 through versions before 14.8.9 (Sonoma)
- macOS 15.0 through versions before 15.7.9 (Sequoia)
- macOS 26.0 through versions before 26.6.1 (Tahoe)
Patch Status
Fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, and macOS Tahoe 26.6.1.
CISA's required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and CISA's "Forensics Triage Requirements." Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and adhering to BOD 26-04 patching guidelines. The KEV due date is 2026-08-21: three days after listing.
Sources
- Apple Security Advisory; https://support.apple.com/en-us/148170
- Apple Security Advisory; https://support.apple.com/en-us/148171
- Apple Security Advisory; https://support.apple.com/en-us/148172
- NVD, CVE-2026-65400, https://nvd.nist.gov/vuln/detail/CVE-2026-65400
- CISA KEV Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400
- CISA BOD 26-04; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance / Forensics Triage; https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- NCSC-NL Advisory NCSC-2026-0280; https://advisories.ncsc.nl/2026/ncsc-2026-0280.html
- Full Disclosure Mailing List; http://seclists.org/fulldisclosure/2026/Aug/36