Security Alert - macOS Screen Sharing Vulnerability

<div><strong>OVERVIEW</strong></div><div>A vulnerability previously identified by Apple in patches released on August 6, 2026 is now under active exploitation with confirmed reports of abuse to deploy crypto miner software.</div><div><br><br></div><div>The vulnerability is a complete authentication bypass via macOS Screen Sharing or Remote Management, which is a superset of controls that includes Screen Sharing. An attacker with network line-of-sight to a vulnerable macOS computer can bypass login requirements without valid user credentials and gain access to the computer.</div><div><strong>&nbsp;</strong></div><div><strong>RECOMMENDATIONS</strong></div><div>Apply macOS updates as soon as possible: <a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuppor... macOS on Mac - Apple Support</a></div><div>Update installation and final restart requires a user password to complete.</div><div><br><br></div><div>Turn off Screen Sharing and Remote Management on unpatched Macs. On an unpatched Mac:</div><ol><li>In the top-left corner of your screen click <strong>Apple Menu &gt; System Settings</strong></li><li>Navigate to <strong>General &gt; Sharing</strong>.</li><li>Disable both/either <strong>Screen Sharing</strong> and <strong>Remote Management</strong>.</li></ol><div><br></div><div>For Jamf admins of managed endpoints, you can remotely turn off Screen Sharing and Remote Management by either:</div><ol><li>Navigating to an individual Mac in Jamf Pro and sending a Disable Remote Desktop command: <a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.... Commands for Computers • Jamf Pro Documentation 11.31.0 • Jamf Learning Hub</a> , or</li><li>Creating a group of your impacted Macs and sending a Disable Remote Desktop command as a Mass Action to that group: <a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.... Actions for Computers • Jamf Pro Documentation 11.31.0 • Jamf Learning Hub</a></li></ol><div><strong><br></strong><br></div><div><strong>SYSTEMS AFFECTED</strong></div><div>macOS computers with either Screen Sharing or Remote Management enabled running any of the versions identified in the table above.</div><div><strong>&nbsp;</strong></div><div><strong>REFERENCES</strong></div><div><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnvd.ni... - cve-2026-65400</a></div><div><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuppor... the security content of macOS Tahoe 26.6.1 - Apple Support</a></div><div><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuppor... the security content of macOS Sequoia 15.7.9 - Apple Support</a></div><div><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsuppor... the security content of macOS Sonoma 14.8.9 - Apple Support</a></div><div><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Farstec... giving attackers full control of Macs is under active exploitation - Ars Technica</a></div>