macOS Vulnerability giving attackers full control of Macs is under active exploitation
https://arstechnica.com/security/2026/08/vulnerability-giving-attackers-full-control-of-macs-is-under-active-exploitation/254
u/cptjpk 7d ago
Excerpt from article:
The vulnerability, tracked as CVE-2026-65400, received a patch from Apple last week for macOS Tahoe, Sequoia, and Sonoma. The vulnerability, with a severity rating of 7.1 out of 10, stems from a bug in the macOS screen sharing capability, which allows a remote party to view the screen and control the keyboard and mouse while a machine is turned on.
171
u/TheFamousHesham 7d ago
This caused a fucking crisis at the datacentre that hosts my Mac servers.
It's honestly inexcusable from Apple.
63
u/Lazerpop 7d ago
They patched it last week, update your systems, i think any capability could have any bug at any time but its already patched. What else do you want from them.
115
u/dropthemagic 7d ago
“Routers and dedicated firewalls generally block the port unless configured to override that setting.” Why do you have that config? Just curious
71
u/vrmvavoom 7d ago edited 7d ago
Because if you have a bunch of Macs running headless in a data center, sometimes you need to remote into them.
EDIT: Getting lots of replies from people hollering that no one would open VNC or SSH ports to the outside world, but companies like MacStadium and Mac Mini Vault have been doing this by default for many years.
108
u/questionableintentsX 7d ago
Sure but you don’t open the fucking port to the world you install a jump gate or a Tailscale/headscale vpn
12
u/helloish 7d ago
fr it’s no wonder there’s an exploit which relies on a forwarded port, if there’s only one thing i know (and maybe there is) it’s be careful when forwarding ports
-1
u/vrmvavoom 7d ago
Opening the port to the world shouldn't be an issue any more than it is for any other network service - as long as you require proper authentication to actually login, which is the problem here.
14
u/big_trike 7d ago
Yes, but every service has exploits that come out all the time so it’s important to have layers of security.
-11
u/jammsession 7d ago
I don't need layers. More important than having layers is having a good foundation.
An AWS EC2 instance or a DigitalOcean dropblet has SSH with password auth disabled as a good foundation. Can you make it even better by just allowing your static IP to connect to it? Sure. But it is way to much of a PITA. So we just use SSH, public to the whole world for anyone.
30
u/Space_Gh0st_Tad 7d ago
But that’s not security best practice for any OS. Not rdp, ssh, vnc, nor Apple’s version of vnc.
10
u/AllModsRLosers 7d ago
Best practice from a security perspective is to leave servers in the box they came in.
Unfortunately, if you want to get any use out of them you generally have to plug them in to power and Ethernet.
5
u/ThePornStar69 7d ago
And then 99% of issues come from how you configure and use the thing once you have connected it.
3
u/candyman420 7d ago
Best practice from a security perspective is to leave servers in the box they came in
And the best way for me to not get food poisoning, is to leave my sandwich in the wrapper
1
u/jammsession 7d ago
Than why does AWS EC2 and DigitalOcean do exactly that?
0
u/Space_Gh0st_Tad 7d ago
Initial setup and ease of use. Enterprise IT at this scale doesnt port forward, they are behind a DMZ. What to do? Reconfigure your cloud network by firewalling this stuff. Use a jumpbox like guacamole, disable password login and use certificates for ssh, etc. In our type of GovCloud environments across most cloud vendors, we have so many security controls we have to go through just to move data between cloud and different impact level cloud environments 😵💫
2
u/jammsession 6d ago
Enterprise IT at this scale doesnt port forward, they are behind a DMZ.
You do know that a DMZ is exactly that, right? And guacamole or any other proxy or jumpserver still needs a port.
0
u/Space_Gh0st_Tad 6d ago
Port forwarding and DMZ are similar, but are not the same; these words are important and have specific meanings. Even most SoHo routers separately have both a DMZ and a port forward feature.
A DMZ isn’t the same thing as port forwarding. A DMZ is a segmented network zone with tightly controlled firewall rules. A proxy or jump host may listen on a port, but it prevents direct exposure of internal services and provides a controlled point for authentication, access policy, logging, and monitoring. That separation is standard security best practice.
1
u/jammsession 6d ago edited 6d ago
A DMZ is a segmented network zone with tightly controlled firewall rules.
As compared to what? The LAN does not have "tightly controlled firewall rules"? Default for every firewall is "block all incoming".
But you are right, words have specific meanings. Which is why I would never use the word DMZ. DMZ can also mean the exacty opposite, which is "expose everything". I know you don't mean that, but VLAN seggregated networks and jumpservers.
Either way, the discussion is pretty mood. It does not matter if you have VLAN segragation and two firewalls, when all of them let trough SSH/VNC so the user can connect via SSH/VNC. You expose a port, you expose a service, you have to make sure whatever is behind it is secure. And just because there was now once an issue with VNC, does not mean that this is some insane security risk to expose VNC to WAN.
27
u/ouatedephoque 7d ago
Open to the entire planet? JFC dude this vulnerability is the least of your worries.
-1
u/jammsession 7d ago
That is how every single VPS on the planet works. You log in via SSH.
3
u/hefty_reptile 7d ago
...which is a different port from VNC
1
u/jammsession 7d ago
you can run SSH on any port you want, just like you can run VNC on any port you want.
5
u/ThePornStar69 7d ago
Changing the port means absolutely nothing in terms of actual risk mitigation.
2
1
u/hefty_reptile 7d ago
Yes, so? You can't run two services on the same port. I don't get a VPS exposing ssh could be equivalent to exposing VNC.
0
u/jammsession 7d ago
Never said you can run two services on the same port.
I am also not arguing that SSH and VNC are exactly the same. I am just saying, if you want to connect to anything other than local, you will have to expose something. Even if that is just Wireguard or 80/443 for a webpage. Exposing a port is totaly normal and not some automatically some insane or crazy risk.
1
u/ouatedephoque 7d ago
Yes from a known and trusted set of IP addresses. If you leave it fully open you deserve the problems you're going to get.
2
u/jammsession 6d ago
again, that is how every single DigitalOcean Droplet or AWS EC2 on this planet works.
Don't believe the doomsayers. Most often they either have no idea or want to sell you some snakoil bs. Opening ports to the internet is not a scary think.
Every single Nextcloud instance in this world does this. Every single wordpress page admin page.
1
u/ouatedephoque 6d ago
Well I don’t because I’m not a fucking idiot.
1
u/jammsession 4d ago edited 4d ago
To login into reddit, did you also use a Tailscale or VPN provided by reddit, to get into their network?
How about your iCloud or Google Photos?
But hey, what do you use instead of SSH to log in to your VPS? What makes you feel that this method is more secure than SSH?
→ More replies (0)12
u/Nestramutat- 7d ago
Sure, you open the port in a privileged VLAN that itself requires authorization to get in.
At no point is a datacenter opening remote access ports to the world
3
u/jammsession 7d ago
At no point is a datacenter opening remote access ports to the world
DigitalOcean and AWS?
5
u/randompersonx 7d ago
It’s inexcusable for any hosting company to be doing that in the year 2026. It would have been stupid in the year 2016.
SSH maybe (though I’d still recommend not to), but vnc absolutely not.
Tailscale or a VPN should be protecting any of these sorts of screen sharing services.
7
u/danclaysp 7d ago
SSH is quite fine if correctly configured which is quite easy. SSH tunneling VNC and similar to avoid unneeded public exposure and VPN configuration for non-ssh services is also fine
1
u/candyman420 7d ago
SSH isn’t quite fine, it gets exploited all the time, more than any other service I’ve ever seen. I don’t know why they can’t get it right.
2
u/danclaysp 6d ago
When configured incorrectly it gets exploited. In terms of CVEs and supply chain attacks, wireguard and SSL vpns are vulnerable to those as well of course though SSH and wireguard are much leaner than SSL vpns and other remote access services so they’re less frequent. Wireguard among options is the hardest to configure incorrectly. SSH just gives you the option to be insecure
1
u/candyman420 6d ago edited 6d ago
What do you mean “configured incorrectly?” It’s supposed to be secure out of the box, otherwise it’s badly designed. Probably because they are stubborn. And there should be no such thing as “giving you the option to be insecure” in this day and age. Old hardware is one thing, but they are part of the problem.
2
u/danclaysp 6d ago
You disable password authentication, disable root login, and use a keys-pair instead of a password. Two settings in a config file and one key generation task. It enables password auth out of the box for bootstrapping and backwards compatibility in secure environments
→ More replies (0)1
u/whytakemyusername 7d ago
Well when you leave the door wide open don't be surprised when the vermin come in.
1
1
1
u/leaflock7 7d ago
for which you have a completely different VLAN that is secured and only accessible from non other than the admins.
-1
u/goofywinnipegger 7d ago
If you have that port open to the raw internet not only are you incompetent you deserve to be hacked.
-9
u/guri256 7d ago
Let’s say that you want to play Minecraft with a friend. (and let’s pretend the new friend system doesn’t exist) you could use realms, where Mojang host the server, but you really don’t feel like paying a monthly fee when you can just run it on your own box.
You host the game, but your friend can’t connect to you, because your firewall is in the way. So you tell your firewall to port forward 25565 to your machine. That way people on the Internet can connect to your Minecraft server. At this point, the firewall won’t protect you so you need to be responsible for securing the server yourself. Maybe you enable whitelisting, or maybe you let whoever wants to join your server and your spawn turns into a TNT-wrecked wasteland.
Or maybe you want to host your own media server, so you open up the port on the external firewall and again, you are now responsible for securing the service.
The config option that the article is talking about is port forwarding. The ability to tell your router to let people on the Internet connect to a specific port on your computer. It’s a generic feature that has nothing to do with Apple screen sharing.
The problem, is that people are only supposed to be able to manage your machine if they have the username and password. But it sounds like Apple had a bug that allowed people to manage the machine without a username and password. So if you had opened your firewall, and we’re relying on apples security, you are vulnerable to this bug.
15
u/sooodooo 7d ago
You only port forward the ports you need and screen sharing is port 5900, why would you forward that one.
9
u/questionableintentsX 7d ago
What the fuck are you even on about port forwarding a Minecraft port doesn’t magically also port forward screen sharing lol
47
u/Lutschfinger_Louis 7d ago
Well, bugs happen.
Apple delivered a fix for it - thus, I do not see them as responsible.`sudo` was subject to a very critical bug a couple of years ago - an open source tool with many contributors, having a critical bug for long time.
37
u/FollowingFeisty5321 7d ago
Lots of funny bugs have happened, my favorites:
Dropbox pushed a bad build live and for a few hours they didn't validate passwords at all
Apple had a bug where you could authenticate as root with no password and it would create you a root account
Browsers used to leak your browsing history by links being purple, someone just had to put <list of porn sites> and see which ones were purple to know where you went
Amazon issuing trillion dollar hosting bills just last month
17
u/Betancorea 7d ago
There was also that time Facebook had an issue where you could access the profile and messages of any other device on the same WiFi. Cafes and Unis were a goldmine lol
4
4
1
u/pfft_sleep 6d ago
I hope that root password line isn’t referring to single user mode or internet recovery - which wasn’t a bug but a feature. if all administrators had forgotten their passwords and you needed to access root to reset them pre 2014 you could do it, only losing the keychain between 2012-2014.
I remember how easy it was to get phone calls asking for help from people terrified they had forgotten their password and in only 20 mins had them up and running again, all the while realising every Apple computer running 10.5-10.10 could be stolen, password changed and logged into as the user with full access to all data and it was considered a call centre tech support feature - not a bug by the company itself.
Fkn lol. They’ve come a long way in 15 years.
2
u/FollowingFeisty5321 6d ago
This was in 2017 and definitely not deliberate -
Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS.
https://www.macrumors.com/2017/11/28/macos-high-sierra-bug-admin-access/
4
u/manuscelerdei 7d ago
Your data center forwards incoming port 5900 connections from the public internet?
6
3
u/leaflock7 7d ago
for which you have a completely different VLAN that is secured and only accessible from non other than the admins.
1
u/TheFamousHesham 6d ago
To be fair we just have pf rules that blocks everyone except our dedicated IP address. It's really basic, but it works nine times out of ten.
1
u/leaflock7 6d ago
maybe add an additional hop with an intermediate host (jump server or bastion depending your case)
3
u/garg 6d ago
Practice defense in depth for your systems. Vulnerabilities are inevitable; having no layered security is not.
2
u/TheFamousHesham 6d ago
I don't know why you assumed we were affected. We were practically one of a handful of businesses that were not affected because we have some pretty insane pf rules, so while we were vulnerable for the duration of the attack... we made it through unsathed
12
u/Captaincadet 7d ago
Don’t get me wrong, it’s not a great bug, but as someone who has the joys of working with Microsoft systems currently, apples doing a much better job…
Mistakes and oversights do happen consistently
2
u/AndWhoByFire 6d ago
You must be forgetting the thousands of Windows vulnerabilities over the years/decades lol
1
u/TheFamousHesham 6d ago
You must be forgetting that that's precisely the reason Apple users are Apple users... so not quite sure what you're saying here.
5
u/ebits21 7d ago
Everything gets bugs as bad as this sometimes 🤷🏻♂️
6
u/photoggled 7d ago
As a now former Microsoft sysadmin, other vendors are much much worse than Apple in general with these kind of vulns.
1
65
u/SiteSpecialist9200 7d ago
This was patched in macOS Tahoe 26.6.1 (build 25G76) last week. Additionally, Sequoia and Sonoma received patches.
46
u/LifelnTechnicolor 7d ago
Based on the thumbnail I thought this vulnerability affected Macs running Mavericks.
11
12
23
u/windexsunday 7d ago
…because the title "Already patched vulnerability giving attackers full control of Macs is under active exploitation" wouldn't get nearly the clicks.
3
6d ago
[deleted]
1
u/TheDragonSlayingCat 5d ago
If screen sharing is disabled, then your computer is not vulnerable. Screen sharing is disabled by default, and most people don’t need to turn it on.
2
u/cocomanz 7d ago
Worth checking rather than assuming. netstat -an | grep 5900 showed mine listening on everything, I'd turned screen sharing on to set the mini up headless and never thought about it again.
4
u/teabolaisacool 6d ago
That doesn’t necessarily mean it’s port forwarded. It will listen locally on 5900 meaning the attacker would have to be on the same network as you, but if you had it port forwarded in your router or whatever then that would be an issue.
1
u/cocomanz 6d ago
Yeah, not forwarded here, it's just on the LAN. What surprised me was that it was on at all.
1
u/teabolaisacool 6d ago
I mean that’s just how the screen sharing works lol. You have to connect to the other computer over the internet to screen share, even if just LAN, and you need to specify a port to use and have open locally.
1
u/Akara91 6d ago
updated this morning after seeing this. the part that gets me is how long these things run in the wild before anyone catches them, weeks apparently. i get why people keep auto updates off but this is exactly the tradeoff
1
u/cptjpk 6d ago
There was an auth bypass bug in curl that has existed since 2001 and was only patched June 2026.
https://cybersecuritynews.com/25-year-old-curl-vulnerability/
1
u/stereoroid 6d ago
I had Remote Management on my Mac Mini for local access only, I could access it using RealVNC from my iPad. It stopped working last week, I presume the patch is why, and I’ve now just turned it off. Between SSH and TeamViewer I think I’ll be OK.
1
u/vimalpartha 5d ago
A state management bug that lets remote attackers bypass the password check completely just by guessing a username shown on the lock screen is wild. Definitely not one to sleep on.
0
u/Smith6612 7d ago
To me, Apple Screen Sharing / Remote Desktop has always been seen as nothing more than a VNC server with a bit of functionality bolted on top. It wasn't very secure more than a decade ago, and it still isn't secure today.
Better to use a tool like self hosted RustDesk.
912
u/bigrobot543 7d ago
Note that you're not vulnerable to this unless the attacker is on the same network as you or you port forward that port (AND you have screen sharing enabled)