Screen Sharing in macOS: A vulnerability that allows access without authentication

A critical security flaw in macOS's screen-sharing feature has been patched after allowing attackers to remotely control Mac computers without authentication. The vulnerability was discovered in at least three versions of macOS, 14 (Sonoma), 15 (Sequoia), and 26 (Tahoe), and was addressed by Apple late Thursday evening. The updated versions are now macOS 14.8.9, 15.7.9, and 26.6.1. The bug, identified under the CVE ID 2026-65400, was found by security researcher Alfred Persoli using Bynario Atlas, a system designed to detect software vulnerabilities through artificial intelligence. The flaw allowed unauthorized users within a local network to access and take control of other Mac devices without needing login credentials. According to Apple’s statement, an attacker could log into the screen-sharing function on affected systems without providing valid authentication. This means that anyone with physical or network access to the device could potentially gain remote control over another Mac, effectively acting as a local user. macOS offers several methods for screen sharing, including basic features available on all Macs and more advanced tools such as Apple Remote Desktop, which costs 90 euros. These tools allow administrators to manage multiple machines efficiently. However, screen-sharing functionality is typically limited to local networks unless specific ports are opened on a router. It remains unclear whether the discovered vulnerability can be exploited beyond this scope, particularly in environments where external internet access is configured, or if the attacker must physically be present on the same network. Apple did not specify whether the screen-sharing feature or Apple Remote Desktop must be active for an attack to occur, nor whether an attack is possible even if screen sharing is disabled by default. On new Macs, screen sharing is usually turned off by default. If enabled, however, an attacker could fully control the device from afar, making such a breach highly dangerous. Additionally, depending on settings, an attacker might be able to wake up a sleeping Mac, even one that is closed and connected to power, to perform remote operations. The fix involves improvements to the “state management” system, though the exact nature of these changes remains undisclosed. Users are strongly advised to update their systems immediately to mitigate potential risks. While it is not clear whether older macOS versions that Apple no longer supports are also vulnerable, it is likely that they could be affected. The company has not commented on this possibility, leaving users to assume that outdated systems may still pose a risk. Security experts emphasize the importance of keeping operating systems up to date, especially when critical flaws are discovered. As the digital landscape continues to evolve, ensuring robust security measures becomes increasingly vital. With the recent patch, Apple has taken a step toward addressing the issue, but vigilance among users remains essential to protect against emerging threats.