CVE-2026-65400 Exploited in the wild
Apple macOS Improper Authentication Vulnerability
- Risk score
- 89/100
- CVSS
- 9.8 v3.1
- Published
- 6 Aug 2026
- Added to CISA's exploited list
- 18 Aug 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
- Affected
- Apple Macos
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Exploited in the wild
Story map
At a glance
Apple Macos: Red, act today. An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
The flaws
- CVE-2026-65400: Apple macOS Improper Authentication Vulnerability (CVSS 9.8 · exploited)
- CVE-2026-86929: Out-of-bounds read can lead to remote code execution (CVSS 8.8 · EPSS 1%)
- CVE-2026-113947: Privilege escalation can lead to remote code execution (CVSS 8.8 · EPSS 1%)
- CVE-2026-112427: Authentication bypass can lead to remote code execution (CVSS 8.1 · EPSS 1%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Apple Macos
Where it stands
- Exploited in the wild
- On CISA's exploited list since 18 Aug
- US federal deadline 21 Aug
- 1 outlet covering it
How it unfolded
- 18 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
- 21 Aug, Deadline (official): US federal agencies must have patched
- 26 Oct, SANS Internet Storm Center (press): Apple Patches for October 2026, (Mon, Oct 26th)
Connects to
- Same weakness: Authentication bypass (CWE-287). 280 other warnings in 30 days
- Same product: Earlier Apple Macos warnings. 20 in the last 90 days
- Reported alongside: An access issue was addressed with improved access restrictions. CVE-2026-86990 · in 1 of the same article
Why it is Red
- CVSS 9.8 critical
- Exploited in the wild (CISA KEV)
- Remotely exploitable without logging in
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
References
- https://support.apple.com/en-us/148170
- https://support.apple.com/en-us/148171
- https://support.apple.com/en-us/148172
- https://support.apple.com/en-us/149035
- https://support.apple.com/en-us/149042
- http://seclists.org/fulldisclosure/2026/Aug/36
- http://seclists.org/fulldisclosure/2026/Aug/37
- https://advisories.ncsc.nl/2026/ncsc-2026-0280.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400
Original description
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
Last activity 18 Aug 2026. Patch Forecast updates every hour.