Critical macOS Flaw Allows Passwordless Access and Is Actively Exploited 2026

A critical macOS vulnerability in the screen sharing service is actively being exploited, allowing attackers to bypass passwords and gain deep system access. Apple has released an emergency update to patch the flaw, tracked as CVE-2026-65400, which affects unpatched Macs.

The vulnerability stems from how macOS implements the Secure Remote Password (SRP) protocol in its screen sharing feature. According to security firm Huntress, the system's authentication management mistakenly accepts connections without requiring valid credentials, enabling attackers to connect to a Mac without a password.

How the macOS Screen Sharing Flaw Works

Apple's advisory describes the issue vaguely as an "authentication problem addressed with improved state management." However, Huntress provides more detail: the flaw lies in the SRP authentication protocol implementation within the screen sharing service. An attacker does not need a valid macOS account, a VNC password, or any action from the victim.

The connection-handling system simply accepts the attacker's authentication as valid. This means a remote attacker can initiate a screen sharing session and gain control without any credentials.

Once connected, the attacker can access the deepest parts of the system. They are not limited to viewing the screen; they can potentially execute commands, access files, and compromise sensitive data. The lack of authentication makes this a severe threat, especially for Macs exposed to the internet.

Why This Vulnerability Is So Dangerous

The active exploitation of CVE-2026-65400 elevates it from a theoretical risk to an immediate danger. Attackers are already using it in real-world attacks, targeting unpatched systems. The fact that no user interaction is required makes it particularly insidious.

Many users leave screen sharing enabled for remote work or support, often without realizing the risk. Even if the service is behind a firewall, insider threats or misconfigurations can expose it. The vulnerability bypasses all password protections, rendering traditional security measures ineffective.

Apple's emergency update is a testament to the severity. The company rarely issues out-of-band patches unless the threat is urgent. This flaw allows complete compromise, and the exploit is already in the wild.

Who Is at Risk?

Any Mac running an unpatched version of macOS with screen sharing enabled is vulnerable. This includes personal users, businesses, and institutions. The risk is highest for systems directly accessible from the internet, but even internal networks are not safe if an attacker gains a foothold.

Remote workers and IT administrators should pay special attention. Screen sharing is often used for remote support and collaboration, making it a common feature. If you haven't updated your Mac recently, you are potentially exposed.

Apple has released security updates for multiple macOS versions. Users should check for updates immediately and install them. The update addresses the authentication flaw by improving state management, though Apple has not disclosed technical details to prevent further exploitation.

What You Need to Do

To protect your Mac, install the latest security update from Apple without delay. Go to System Settings > General > Software Update and install any available updates. If you use screen sharing, consider disabling it until the update is applied.

Additionally, review your network security. Ensure that screen sharing is not exposed to the public internet. Use firewalls and VPNs to restrict access to trusted networks. Regularly monitor for unusual activity, such as unexpected screen sharing sessions or login attempts. The background to this story is set out in Critical PHP Flaw Puts Half the Internet at Risk Worldwide. A related thread runs through PHP Code Flaw Triggers Millions of Exploit Attempts Worldwide. Earlier coverage in PHP Code Flaw Triggers Global Exploit Attempts: What Website Owners shows how the argument developed.

For businesses, patch management is critical. Ensure all Macs in your organization are updated promptly. Educate employees about the risks of leaving remote access services enabled unnecessarily. A closer look at the same subject appears in Meta Smart Glasses Privacy Flaw Records Chats Without Permission. Anyone following the wider picture can start with iOS 27, iPadOS 27, watchOS 27 and macOS 27: Release Dates and Compatible. The same theme surfaces in Technology: latest articles, which takes a different angle.

Key Takeaways

• CVE-2026-65400 is a critical macOS screen sharing flaw that allows passwordless access.
• Attackers can exploit it without any user interaction or valid credentials.
• The vulnerability is actively being exploited in the wild.
• Apple has released an emergency update to patch the issue.
• Unpatched Macs with screen sharing enabled are at high risk.
• Users should update immediately and consider disabling screen sharing if not needed.

Comparison of macOS Versions Affected

Note: Version numbers are illustrative; check Apple's security updates page for exact versions. Context on how this played out before sits in Meta's 'Big Tobacco' Moment: 29 States Sue Over Addictive Facebook.