CISA Warns of Apple macOS Vulnerability Exploited in Attack (CVE-2026-65400)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently acknowledged the active exploitation of the macOS vulnerability. Tracked as CVE-2026-65400, the vulnerability affects macOS Tahoe, macOS Sequoia, and macOS Sonoma. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog, urging users to patch it before August 21, 2026.

Alfredo Pesoli via Bynario Atlas discovered and reported the vulnerability to Apple.

The authentication flaw impacts the Screen Sharing component, which could allow an attacker already on the network to authenticate to the built-in remote desktop feature service without valid credentials. Apple addressed the vulnerability with improved state management.

Affected Products and Versions

• macOS Tahoe versions before 26.6.1
• macOS Sequoia versions before 15.7.9
• macOS Sonoma versions before 14.8.9

Mitigation

Apple released the following versions to patch the vulnerability:

• macOS Tahoe 26.6.1
• macOS Sequoia 15.7.9
• macOS Sonoma 14.8.9

For more information, please visit the Apple security advisories for macOS Tahoe, Sequoia, and Sonoma.

Qualys Detection

Qualys customers can scan their devices with QIDs 388223, 388224, and 388225 to detect vulnerable assets.

Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.

References
https://support.apple.com/en-us/148170
https://support.apple.com/en-us/148171
https://support.apple.com/en-us/148172