Your Mac is open on the network. Anyone on the same network can authenticate into Screen Sharing without credentials. No password, no interaction, no privileges.
The flaw
CVE-2026-65400 is an authentication flaw in macOS Screen Sharing. CVSS 9.8 critical. Attack vector: network. Complexity: low. Privileges: none. User interaction: none. Full impact on confidentiality, integrity and availability.
Apple classified it as improper authentication, CWE-287. CISA raised the score from a lower version to 9.8 on August 14, eight days after the patch. Automatable: yes. Technical impact: total.
The scope
Affected versions: macOS Sonoma before 14.8.9, Sequoia before 15.7.9, Tahoe before 26.6.1. If you have a corporate Mac with Screen Sharing enabled and it is not updated, it is exposed.
The patch shipped on August 6. Apple published three advisories: HT148170, HT148171, HT148172. Full Disclosure came on August 13. Researcher Alfredo Pesoli, known as @__rev, reported it via Bynario Atlas.
Why Screen Sharing is the worst possible target
Screen Sharing is the macOS RDP. It was always treated as safe because Macs were not targets. Now they are. A network vector, no credentials, full impact, in a service that comes enabled by default in many corporate installations.
The risk window is real. The patch has existed since August 6. Every unpatched Mac is an open door for any attacker on the local network. In corporate environments with hundreds of Macs, a single unpatched host compromises the entire network.
It is the same risk design of the remote services we already analyzed here: the Windows kernel RCE via SMB/RDP and ksmbd on Linux. The response has the same shape in all three: minimal surface, immediate patch, and segmentation that contains whatever escapes.
The rule
The rule is simple: if you do not need Screen Sharing, disable it. If you need it, update now. macOS Sonoma 14.8.9, Sequoia 15.7.9 or Tahoe 26.6.1.
At Tech86, we harden endpoints before the incident: asset inventory, automated patch management, monitoring of exposed services and a response plan for critical CVEs.
Conclusion
The patch you do not apply is the vulnerability you chose to keep. In this case, it is a passwordless door in your Mac''s remote access protocol, open to anyone on the same network since August. The fleet check takes an afternoon; the incident it prevents has no closing price.