{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "macos-screen-sharing-attacked-bug-aug-2026",
  "url": "https://patchgap.ai/incidents/macos-screen-sharing-attacked-bug-aug-2026/",
  "path": "/incidents/macos-screen-sharing-attacked-bug-aug-2026/",
  "json_url": "https://patchgap.ai/incidents/macos-screen-sharing-attacked-bug-aug-2026.json",
  "title": "Mac: a Screen Sharing bug let attackers on the network get in without a password",
  "category": "mac",
  "platforms": [
   "macos"
  ],
  "products": [
   "macos"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
  "exploited_in_wild": "yes",
  "exploited_note": "CISA lists it as used in real attacks (added Aug 18, 2026).",
  "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-08-06",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-65400"
  ],
  "summary": "If Screen Sharing is turned on, a bug let someone on the same network connect to your Mac without the right password. Apple fixed it on August 6, 2026. Most home users have Screen Sharing turned off.",
  "am_i_affected": "You are at risk if Screen Sharing is on and your Mac runs macOS Tahoe older than 26.6.1, Sequoia older than 15.7.9 or Sonoma older than 14.8.9. Check System Settings > General > Sharing.",
  "action": "Update macOS (Aug 2026 update or newer)",
  "affected": [
   {
    "product": "macos",
    "product_name": "macOS",
    "platform": "macos",
    "affected_versions": "macOS Tahoe before 26.6.1, Sequoia before 15.7.9, Sonoma before 14.8.9",
    "fixed_version": "26.6.1 (Tahoe) / 15.7.9 (Sequoia) / 14.8.9 (Sonoma)",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://support.apple.com/en-us/148170",
     "https://support.apple.com/en-us/148171",
     "https://support.apple.com/en-us/148172"
    ],
    "check": {
     "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
     "command": "sw_vers -productVersion",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://support.apple.com/en-us/108382"
   }
  ],
  "fix_steps": [
   "Click the Apple menu > System Settings > General > Software Update.",
   "Install the update it offers.",
   "Restart your Mac when asked.",
   "If you do not use it, turn off Screen Sharing in System Settings > General > Sharing."
  ],
  "official_patch_links": [
   {
    "label": "Apple: update macOS on your Mac",
    "url": "https://support.apple.com/en-us/108382"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://support.apple.com/en-us/148170",
    "title": "Apple: About the security content of macOS Tahoe 26.6.1",
    "date": "2026-08-06",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/148171",
    "title": "Apple: About the security content of macOS Sequoia 15.7.9",
    "date": "2026-08-06",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/148172",
    "title": "Apple: About the security content of macOS Sonoma 14.8.9",
    "date": "2026-08-06",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-65400 (added 2026-08-18)",
    "date": "2026-08-18",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65400",
    "title": "NVD: CVE-2026-65400",
    "date": "2026-08-06",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}