WASHINGTON, 20 AUG 2026 — A macOS Screen Sharing flaw that Apple rated 7.1 has been rescored by CISA at 9.8 and added to the federal known-exploited catalogue. Attackers are using it to take root on Macs with port 5900 exposed to the internet, and installing cryptocurrency miners.
Yesterday we wrote about an Apple image-parsing bug with no disclosed exploitation. This is the one in the same patch cycle that is actually being used.
The flaw
The defect sits in the Screen Sharing service's implementation of Secure Remote Password, and it lets an attacker on the network authenticate without valid credentials. Reported analysis describes the result as pre-authenticated remote code execution across supported macOS versions.
Apple shipped out-of-band patches on 6 August. The Dutch national cyber security centre reported active exploitation on 12 August against Macs with port 5900 reachable from the internet; in every case reported to it, the attacker obtained root and installed a Monero miner. CISA added the flaw to its catalogue on 18 August.
The gap between the 7.1 and 9.8 scores is the important part.
A vendor and a government agency looked at the same flaw and reached scores nearly three points apart, which is a large gap on a ten-point scale and not an error by either.
Severity scoring bakes in assumptions about how a product is deployed. Screen Sharing is designed to be reachable on a trusted local network, and scored on that assumption a network-adjacent authentication bypass is serious but bounded. Scored on the assumption that some meaningful number of Macs have port 5900 facing the open internet, the same flaw is unauthenticated remote root, which is where 9.8 comes from.
Both readings are defensible and only one of them matches what the Dutch reports describe. The practical lesson: a vendor's score reflects the intended deployment, but your risk depends on your actual one.
Cryptomining is the tell, not the threat
Using root access on a Mac just to install a Monero miner seems anticlimactic, but it is the most informative detail here.
Miners are what opportunistic mass exploitation deploys. Nobody spends a targeted capability on cryptocurrency; they spend it on data. A campaign that sweeps the internet for exposed port 5900 and drops a miner on everything it finds is telling you the exploitation is indiscriminate, automated and running at whatever scale the exposed population supports.
This tells us two things. On one hand, the attack is indiscriminate; victims were likely compromised by an automated scan of an address range, not targeted by name. On the other, root access is root access. The same foothold used to install a miner can install anything else, and access bought in bulk can be resold to an attacker with more specific interests.
A miner is not just a nuisance to be cleaned up. It is evidence that the host was fully compromised by an automated process. The only honest remediation is a rebuild.
Why Macs are exposed on port 5900 at all
Almost nobody deliberately publishes Screen Sharing to the internet. The exposure comes from ordinary decisions that individually looked reasonable.
A developer enables remote access to reach a build machine from home. A small studio port-forwards on the office router because the alternative was configuring a VPN. A cloud Mac instance, rented for continuous integration or iOS builds, is provisioned with remote access on by default and a public address by definition. A rented Mac in a colocation rack has no local network to be trusted on at all.
That last category — rented Mac infrastructure — is the one to check first. Mac hosting for build and test workloads has grown quickly, the machines are managed remotely by necessity, and they are frequently outside whatever asset inventory the security team maintains — because they were paid for on a card by an engineering team that needed a build runner.
The same forty-eight hours, again
We reported that 88 per cent of observed exploitation against flaws with public proof-of-concept code happens within 48 hours, and yesterday on a vCenter campaign that took 361 victims in roughly seventy-two hours.
This one follows the same clock: patched 6 August, exploitation reported 12 August, catalogued 18 August. An organisation with a monthly patch cycle was exposed for the entire window and is finding out through a federal catalogue rather than through its own process.
The Apple flaw we covered yesterday, an ImageIO integer overflow, still has no disclosed exploitation. Two flaws, one vendor, one fortnight, and the one being used is the boring authentication bug rather than the sophisticated parser bug. That is usually how it goes.
What to do today
Patch to macOS Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9. Then find out whether any Mac you are responsible for answers on port 5900 from outside your network, which is a scan rather than a project.
If one does and was unpatched at any point since 6 August, treat it as compromised. Look for unexplained processes consuming CPU, unfamiliar launch daemons and agents, accounts you did not create, and outbound connections to mining pools. A rebuild is the honest remediation.
For a durable fix, Screen Sharing should only be exposed to the internet through a VPN, if at all. Turning off the service where it is not needed removes the entire class, and on a build fleet that is a configuration change rather than a migration.
What we could not establish
The scale. The Dutch agency describes what was reported to it, which is a floor rather than a count, and no global figure for compromised hosts has been published.
Also unestablished: how many Macs currently expose port 5900 to the internet; whether exploitation began before the 6 August patch; whether the same access has been used for anything other than mining; who is running the campaign; whether cloud Mac providers have patched their fleets or notified customers; and what proportion of affected machines are corporate rather than personal.
What to watch
Watch for a second payload. Opportunistic access is routinely resold, and a campaign that starts with miners often ends with something else on the subset of hosts that turn out to matter.
Then watch the cloud Mac providers. They operate exactly the exposed, remotely managed fleet this flaw targets, and how quickly they patched and whether they told customers is a fair question that has not been answered publicly.
Finally, watch whether other agencies rescore the flaw. CISA moving a vendor's 7.1 to 9.8 is a public disagreement about deployment assumptions, and if national agencies elsewhere follow, the vendor score becomes something buyers will trust rather less.
View author profile → · Editorial policy
