Screen Sharing in macOS: Vulnerability allowed access without authentication
Apple released important updates for the last three macOS versions on Friday night. They fix a severe vulnerability in internal networks.
Apple keyboard with padlock: macOS had a screen sharing problem.
(Image: ArtVibe1 / Shutterstock)
A vulnerability exists in at least three macOS versions, which attackers could use to remotely control other Macs on the local network. The bug in the so-called Screen Sharing function was fixed by Apple late Thursday evening and affects macOS 14 (Sonoma), macOS 15 (Sequoia), and macOS 26 (Tahoe).
No credentials necessary
The current version numbers with bug fixes are now macOS 14.8.9, 15.7.9, and 26.6.1. The bug, under CVE ID 2026-65400, was discovered by security researcher Alfred Persoli via the Bynario Atlas platform, an AI system for detecting vulnerabilities. Apple has not yet provided further details. The company only stated that “an attacker on the network” had the opportunity to log in to Screen Sharing on affected Macs without needing valid credentials.
Videos by heise
macOS offers several ways to share screens, referred to in German as „Zugreifen auf den Bildschirm eines anderen Computers“ or “Bildschirmfreigabe” (Screen Sharing). The simplest option is available on all Macs (both sharing and remote control); professional users use Apple Remote Desktop, which includes various administration functions and costs 90 Euros. If the Mac is on a local network and no corresponding ports are forwarded in the router, remote screen sharing is not possible. It is currently unclear whether the discovered bug can also be exploited if users have set up access from the internet (e.g., in companies), or if the attacker actually needs to be on the local network.
Update urgently!
Apple also did not state whether Screen Sharing and/or Apple Remote Desktop (via the “Computer Management” function in the Sharing settings) must be active for access, or if an attack can occur even if screen sharing is generally disabled. The latter is the default on new Macs. With Screen Sharing, an attacker can remotely control the entire Mac as if they were a local user. Such an attack is correspondingly dangerous. Depending on the settings, it is also possible to wake the Mac from sleep to control it remotely – even if a MacBook is closed and connected to power.
According to Apple, the “authentication error” has been fixed by improving “state management”. What exactly this means remains unclear. What is clear is that users should update the three affected macOS versions as soon as possible. It has not been communicated whether older macOS versions that Apple no longer maintains are also vulnerable – but it is quite possible.
Empfohlener redaktioneller Inhalt
Mit Ihrer Zustimmung wird hier ein externer Preisvergleich (heise Preisvergleich) geladen.
Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (heise Preisvergleich) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung.
(bsc)
