Patch Gap

Mac · updated Oct 27, 2026

Mac: a Screen Sharing bug let attackers on the network get in without a password

Patched: update nowBeing attacked nowHigh

Last checked · Check before installing; only use the official link.

If Screen Sharing is turned on, a bug let someone on the same network connect to your Mac without the right password. Apple fixed it on August 6, 2026. Most home users have Screen Sharing turned off.

Status
Patched: update now
Being attacked?
Yes[4]
Severity
High
Updated

CISA lists it as used in real attacks (added Aug 18, 2026). Severity: Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked). First reported .

Am I affected?

You are at risk if Screen Sharing is on and your Mac runs macOS Tahoe older than 26.6.1, Sequoia older than 15.7.9 or Sonoma older than 14.8.9. Check System Settings > General > Sharing.

AppDeviceAffectedFixed in
macOSMacmacOS Tahoe before 26.6.1, Sequoia before 15.7.9, Sonoma before 14.8.926.6.1 (Tahoe) / 15.7.9 (Sequoia) / 14.8.9 (Sonoma)[1][2][3]

How to check your version

These checks only look. They do not change anything on your computer.

macOS on Mac

Easy way: Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.

Or type this in TerminalRead-only. It only reads the version and changes nothing.

sw_vers -productVersion

How to fix it

  1. Click the Apple menu > System Settings > General > Software Update.
  2. Install the update it offers.
  3. Restart your Mac when asked.
  4. If you do not use it, turn off Screen Sharing in System Settings > General > Sharing.

More on each app: Is my Mac up to date?

Official links

Check before installing, and only use these official links or the app's own update button.

For AI agents

This page as data: /incidents/macos-screen-sharing-attacked-bug-aug-2026.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.

Tracking numbers (CVE): CVE-2026-65400

Sources

  1. MakerApple: About the security content of macOS Tahoe 26.6.1 (Aug 6, 2026)
  2. MakerApple: About the security content of macOS Sequoia 15.7.9 (Aug 6, 2026)
  3. MakerApple: About the security content of macOS Sonoma 14.8.9 (Aug 6, 2026)
  4. CISACISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-65400 (added 2026-08-18) (Aug 18, 2026)
  5. NVDNVD: CVE-2026-65400 (Aug 6, 2026)

"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.