Dutch officials have warned that a high-severity macOS vulnerability that allows attackers to execute malicious code is under active exploitation.<\/p>\n
\u201cThe NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,\u201d the Netherlands National Cyber Security Centrum warned<\/a> earlier this week. \u201cIn all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed.\u201d<\/p>\n The vulnerability, tracked as CVE-2026-65400, received a patch from Apple last week for macOS Tahoe<\/a>, Sequoia<\/a>, and Sonoma<\/a>. The vulnerability, with a severity rating of 7.1 out of 10, stems from a bug in the macOS screen sharing capability, which allows a remote party to view the screen and control the keyboard and mouse while a machine is turned on. A flaw in the \u201cstate management,\u201d which keeps track of preceding events, user interactions, variables, and other system states, is the underlying cause.<\/p>\nDo you know if your screen sharing is on?<\/h2>\n