macOS Screen Sharing CVE-2026-65400: Bypassing Authentication to Mine Cryptocurrency

> TL;DR: CVE-2026-65400 (CVSS 9.8) is an improper authentication vulnerability in macOS Screen Sharing that lets a network-based attacker authenticate to the service without valid credentials. The flaw was exploited to deploy Monero cryptocurrency miners before CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026, with a patch deadline of August 21 for U.S. federal agencies.

The flaw in brief

macOS Screen Sharing is designed to allow authenticated remote access to a machine. A flaw in the credential validation logic allows an attacker to bypass that check and gain access without holding a valid account on the target machine — a particularly dangerous combination for a service specifically designed to provide remote control.

Why cryptomining is often the first signal, not the worst-case scenario

The exploitation observed so far deploys Monero miners — a relatively quiet, low-impact use compared to ransomware or data theft. But this is often the pattern with newly discovered remote-access flaws: the first exploiters are opportunistic and looking for quick profit (mining), while more sophisticated actors analyze the flaw for more targeted uses (data theft, lateral movement, ransomware). Finding a Monero miner on a machine is a warning sign that unauthorized access exists — not proof that the impact is limited to mining.

What to do

What CleanIssue checks for

During a fleet audit, we check the exposure of remote-access services (Screen Sharing, VNC, RDP) and the robustness of their authentication, in addition to standard web and API surfaces.

Key takeaways