CVE-2026-65400

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.017 · 77 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 3 exploits · PoC

Likely / severe?

1.72% (77th) EPSS

CVSS 9.8 · critical

Is it mine?

22 products

Check your exposure

Who says so?

5 sources

enisa_euvd · fstec_bdu · cert_bund · ncsc_nl

added 2026-08-18remediate by 2026-08-21

required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

EPSS · scored 2026-10-23

Apple macOS Improper Authentication Vulnerability

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.1–9.8

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USCWE-287US

exploits (3)

Public proof-of-concept and weaponised exploit code.

HORKimhab/CVE-2026-65400CVE-2026-65400PoC · poc_in_github
acheong08/CVE-2026-65400Apple MacOS Screen Sharing Arbitrary File read/write -> RCEPoC · poc_in_github
panchocosil/CVE-2026-65400-pocRead-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.PoC · poc_in_github

affected products (22)

Products and version ranges known to be affected.

Apple IOS< 26.7cert_bundDE
Apple IOS< 27cert_bundDE
Apple Safari< 27cert_bundDE
Apple iPadOS< 26.7cert_bundDE
Apple iPadOS< 27cert_bundDE
Apple macOS≤ Golden Gate <27cert_bundDE
Apple macOS≤ Sequoia <15.8cert_bundDE
Apple macOS≤ Tahoe <26.7cert_bundDE
Apple macOS0 → 14.8.9enisa_euvdEU
Apple macOS0 → 15.7.9enisa_euvdEU
Apple macOS0 → 26.6.1enisa_euvdEU
Apple Inc. MacOS≤ 26.6.1fstec_bduRU
Apple Inc. MacOS≤ 15.7.9fstec_bduRU
Apple Inc. MacOS≤ 14.8.9fstec_bduRU
Apple macOS≤ vers:unknown/*ncsc_nlNL
Apple macOS Golden Gate≤ vers:unknown/*ncsc_nlNL
Apple macOS Sequoia≤ vers:unknown/*ncsc_nlNL
Apple macOS Sonoma≤ vers:unknown/*ncsc_nlNL
Apple macOS Tahoe≤ vers:unknown/*ncsc_nlNL
apple macos14.0 → 14.8.9nvdUScpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

showing 20 of 22

advisories (4)

Vendor and ecosystem advisories describing this.

NCSC-2026-0280Kwetsbaarheid verholpen in macOS Screen Sharing door AppleNL2026-08-07csaf · ncsc_nlNL
Apple heeft een kwetsbaarheid verholpen in de Screen Sharing feature van macOS versies Sequoia 15.7.9, Sonoma 14.8.9 en Tahoe 26.6.1.
NCSC-2026-0371Kwetsbaarheden verholpen in Apple macOS en Samba door Apple en SambaNL2026-09-15csaf · ncsc_nlNL
Apple heeft meerdere kwetsbaarheden verholpen in macOS (Specifiek voor Golden Gate 27, Sequoia 15.8, Tahoe 26.7).
WID-SEC-W-2026-2687Apple macOS (Sonoma, Sequoia und Tahoe): Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-08-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apple macOS ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2026-3352Apple iOS, iPadOS, macOS Tahoe, macOS Golden Gate, macOS Sequoia und Safari: Mehrere SchwachstellenDeutsch2026-09-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apple iOS, iPadOS, macOS Tahoe, macOS Golden Gate, macOS Sequoia and Safari ausnutzen,, um beliebigen Code mit Root- oder Kernel-Rechten auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, auf Daten zuzugreifen, diese zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände herbeizuführen.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

enisa_euvd fstec_bdu cert_bund ncsc_nl nvd NVD CVE.org MITRE

published 2026-08-06modified 2026-10-24

references (12)

External citations — patches, advisories, analysis.

https://support.apple.com/en-us/148170 enisa_euvd
https://support.apple.com/en-us/148171 enisa_euvd
https://support.apple.com/en-us/148172 enisa_euvd
http://seclists.org/fulldisclosure/2026/Aug/36Mailing Listnvd
http://seclists.org/fulldisclosure/2026/Aug/37Broken Linknvd
https://advisories.ncsc.nl/2026/ncsc-2026-0280.htmlThird Party Advisorynvd
https://support.apple.com/en-us/148170Release NotesVendor Advisorynvd
https://support.apple.com/en-us/148171Release NotesVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan