The flaw and its impact
The vulnerability could let an attacker on the network bypass Screen Sharing authentication and remotely control a Mac. This would allow them to open apps, view files, or perform actions based on the session's permissions. Though there is no confirmed evidence of real-world attacks, Apple's move to patch it urgently shows the flaw was considered a serious threat.
The issue centers on authentication being bypassed in Screen Sharing, a feature used for remote access. Apple's security details explain that the vulnerability allowed remote attackers to log in without the correct credentials. Once inside, an attacker's capabilities depend on how the system is configured and the level of access granted to the session. This could lead to unauthorized viewing or manipulation of files and settings.
The affected macOS versions
Apple released patches for macOS Sonoma 14.8.9, Sequoia 15.7.9, and Tahoe 26.6.1. All versions now include a fix aimed at improving state management to prevent unauthorized access. Apple did not include the patch in earlier beta versions, which highlights the urgency and critical nature of the vulnerability.
The updates were pushed out to users through regular channels, with release notes stating that important security fixes were included. Apple typically reserves such wide-reaching updates for major threats, which underscores the seriousness of the issue. The updates cover three major macOS versions, showing the scope of the problem and the importance of quick action.
Why update ASAP
Even if users don’t use Screen Sharing regularly, Apple’s decision to push this update across three versions suggests a real and present risk. Installing the update immediately is recommended rather than waiting. The fix is associated with CVE-2026-65400, and the credit is given to Alfredo Pesoli through Bynario Atlas. This shows that independent researchers played a key role in uncovering and reporting the flaw.
Apple’s security team emphasized the need for users to act quickly, even if the vulnerability wasn't exploited in practice. The company’s choice to skip beta testing and deliver the fix in this manner highlights the urgency. Given the potential impact of unauthorized access, users are advised to update their systems as soon as possible to ensure full protection.