High-Severity macOS Vulnerability Allowing Full System Control Under Active Exploitation, Dutch Officials Warn

Dutch officials have issued a stark warning concerning the active exploitation of a high-severity vulnerability within Apple's macOS operating system, identified by the identifier CVE-2026-65400. This critical flaw grants attackers the ability to execute arbitrary malicious code on affected systems, effectively providing them with complete control. The Netherlands National Cyber Security Centrum (NCSC), a governmental cybersecurity agency, reported observing "active abuse of this vulnerability on multiple systems on which port 5900 was accessible from the Internet." This specific observation is significant as port 5900 is commonly associated with Remote Desktop Protocol (RDP) and Virtual Network Computing (VNC) services, which are often used for remote access and screen sharing. In all documented instances of exploitation detailed by the NCSC, attackers successfully escalated their privileges to gain root access on the compromised systems. Following this unauthorized access, they proceeded to deploy a Monero cryptocurrency miner, a type of malware designed to leverage the victim's computing resources for mining digital currency without their consent. The NCSC's warning specifically highlighted the elevated risk posed by screen sharing functionalities being enabled and accessible externally, underscoring the importance of secure remote access configurations.

In response to this emerging threat, Apple, the technology giant responsible for macOS, released a patch for this vulnerability last week. This security update addresses CVE-2026-65400 in the latest versions of its operating system, specifically targeting macOS Tahoe, macOS Sequoia, and macOS Sonoma. The vulnerability carries a significant severity rating of 7.1 out of a possible 10, indicating a high potential for damage and exploitation. The root cause of this flaw lies within the macOS screen sharing capability. This feature is designed to allow authorized remote users to view and control a Mac's screen, keyboard, and mouse, facilitating support or collaboration. However, a critical bug in the "state management" component of this functionality was discovered. State management is a fundamental aspect of software operation, responsible for meticulously tracking preceding events, user interactions, system variables, and other crucial operational states to ensure the program functions correctly. The failure in this state management mechanism allowed for the unauthorized execution of code, paving the way for subsequent system compromise and the installation of malicious software.

The NCSC's alert serves as a critical and timely reminder for all macOS users to ensure their systems are updated promptly with the latest security patches provided by Apple. The fact that this vulnerability is under active exploitation indicates that malicious actors are proactively searching for and leveraging this weakness to infiltrate Mac systems for illicit purposes, such as the aforementioned cryptocurrency mining. The accessibility of port 5900, as noted by the NCSC, was a key enabler in the successful exploitation of this vulnerability, suggesting that systems with open or improperly secured remote access services are particularly vulnerable. Users are strongly advised to review their network configurations, specifically examining their firewall settings and screen sharing preferences, to mitigate potential exposure to this and similar threats.