CVE-2026-65400: Apple macOS Screen Sharing Authentication Bypass — Detection and Remediation Guide

---
title: macOS Screen Sharing Service Enabled via Command Line
id: 3f8a1d42-7b6e-4c59-a1d2-9e0f5c8b7a34
status: experimental
description: Detects command-line enablement of macOS Screen Sharing or Apple Remote Desktop, a common attacker action for persistent remote access following initial compromise such as CVE-2026-65400 exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65400
  - https://attack.mitre.org/techniques/T1021/005/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.lateral_movement
  - attack.t1021.005
  - attack.persistence
logsource:
  category: process_creation
  product: macos
detection:
  selection_launchctl:
    CommandLine|contains:
      - 'com.apple.screensharing'
      - 'com.apple.RemoteDesktop'
  selection_kickstart:
    CommandLine|contains:
      - 'ARDAgent.app/Contents/Resources/kickstart'
      - '-activate'
      - '-configure -access'
  condition: selection_launchctl or selection_kickstart
falsepositives:
  - Legitimate MDM or administrator enablement of remote management
level: high
---
title: Suspicious Inbound VNC Connection to macOS Screen Sharing
id: 8c2e5b91-4a3d-4f78-b6e1-2d9c0a7e5f12
status: experimental
description: Detects inbound network connections to TCP 5900 (Apple Screen Sharing / VNC) on macOS endpoints. Exploitation of CVE-2026-65400 produces inbound sessions from attacker-controlled hosts outside expected admin sources.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65400
  - https://attack.mitre.org/techniques/T1021/005/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.lateral_movement
  - attack.t1021.005
  - attack.initial_access
logsource:
  category: network_connection
  product: macos
detection:
  selection:
    DestinationPort: 5900
    Initiated: 'false'
  filter_admin_range:
    SourceIp|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: selection and not 1 of filter_admin_range*
falsepositives:
  - Helpdesk or IT remote support sessions from unmapped subnets
level: high
---
title: macOS Screensharingd Spawning Interactive Shell or Utility
id: 1d7f4c60-9b2a-4e85-c3d6-8a1f0b9e2d47
status: experimental
description: Detects screensharingd or related Screen Sharing components spawning shells or command-line utilities, consistent with an attacker operating through a hijacked GUI session after CVE-2026-65400 authentication bypass.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65400
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.execution
  - attack.t1059.004
  - attack.lateral_movement
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|contains:
      - 'screensharingd'
      - 'AppleVNCServer'
      - 'ScreensharingAgent'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/sh'
      - '/curl'
      - '/python3'
      - '/osascript'
      - '/dscl'
      - '/sysadminctl'
  condition: all of selection_*
falsepositives:
  - Administrators running Terminal during legitimate remote support sessions
level: critical

// Hunt for anomalous inbound Screen Sharing (TCP/5900) connections on macOS endpoints
// via Microsoft Defender for Endpoint on macOS. Scope RemoteIP filtering to your
// legitimate admin/helpdesk ranges before operationalizing.
let Lookback = 14d;
let AdminRanges = dynamic(["10.10.0.0/16", "192.168.50.0/24"]); // UPDATE: legitimate remote support subnets
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where LocalPort == 5900 or RemotePort == 5900
| where ActionType == "InboundConnectionAccepted" or (RemotePort == 5900 and not(ipv4_is_in_any_range(RemoteIP, AdminRanges)))
| extend IsPrivateRemote = ipv4_is_private(RemoteIP)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ConnectionCount = count(),
            RemoteIPs = make_set(RemoteIP), LocalPorts = make_set(LocalPort)
    by DeviceName, LocalIP, InitiatingProcessFileName
| extend Suspicion = iif(IsPrivateRemote == false, "EXTERNAL SOURCE - INVESTIGATE IMMEDIATELY", "Internal - verify against admin change records")
| order by LastSeen desc;

// Companion hunt: Screen Sharing / ARD enablement processes on macOS endpoints
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("launchctl", "kickstart")
| where ProcessCommandLine has_any ("com.apple.screensharing", "com.apple.RemoteDesktop", "kickstart", "-activate", "-configure")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| order by TimeGenerated desc;

-- Hunt macOS endpoints for active Screen Sharing listeners, established VNC
-- sessions, and evidence of service enablement relevant to CVE-2026-65400.
-- Deploy as a Velociraptor hunt across the Mac fleet.

-- Part 1: Find endpoints listening on 5900 and any established VNC sessions
SELECT Pid, Name AS Process, Address AS LocalAddr, Port AS LocalPort,
       Status, Family
FROM netstat()
WHERE LocalPort = 5900

-- Part 2: Check Screen Sharing / Remote Management launchd state
SELECT FullPath, Mtime, Size
FROM glob(globs=[
  '/System/Library/LaunchDaemons/com.apple.screensharing.plist',
  '/Library/Preferences/com.apple.ScreenSharing.plist',
  '/Library/Preferences/com.apple.RemoteDesktop.plist',
  '/Library/Application Support/Apple/Remote Desktop/'
])

-- Part 3: Processes indicating active remote session tooling
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)screensharing|AppleVNCServer|ARDAgent'
   OR CommandLine =~ '(?i)screensharing|kickstart'

#!/bin/bash
# CVE-2026-65400 macOS Screen Sharing Triage & Hardening Script
# Run via MDM (Jamf, Kandji, Intune) or manually with sudo.
# Preserves forensic evidence BEFORE changing state, per CISA Forensics Triage Requirements.

EVIDENCE_DIR="/private/tmp/cve_2026_65400_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$EVIDENCE_DIR"

echo "=== [1/6] Capturing current Screen Sharing / Remote Management state ==="
launchctl list 2>/dev/null | grep -iE 'screensharing|remotedesktop|ardagent' > "$EVIDENCE_DIR/launchctl_state.txt"
ls -la /Library/Preferences/com.apple.ScreenSharing.plist 2>/dev/null >> "$EVIDENCE_DIR/launchctl_state.txt"
ls -la "/Library/Application Support/Apple/Remote Desktop/" 2>/dev/null >> "$EVIDENCE_DIR/launchctl_state.txt"

echo "=== [2/6] Capturing active connections on TCP/5900 ==="
lsof -nP -iTCP:5900 > "$EVIDENCE_DIR/vnc_connections.txt" 2>/dev/null
netstat -an | grep '\.5900' >> "$EVIDENCE_DIR/vnc_connections.txt"

echo "=== [3/6] Extracting Screen Sharing auth events from unified log (last 14 days) ==="
log show --last 14d --predicate 'process == "screensharingd" OR subsystem CONTAINS "screensharing"' \
  --style compact > "$EVIDENCE_DIR/screensharing_log.txt" 2>/dev/null
echo "Review $EVIDENCE_DIR/screensharing_log.txt for 'Authentication' events from unexpected sources."

echo "=== [4/6] Checking OS update status ==="
sw_vers
softwareupdate --list 2>/dev/null | tee "$EVIDENCE_DIR/pending_updates.txt"

echo "=== [5/6] DISABLING Screen Sharing (interim mitigation until patch applied) ==="
launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist 2>/dev/null && \
  echo "Screen Sharing service unloaded and disabled." || echo "Screen Sharing was not loaded or unload failed."

echo "=== [6/6] Blocking TCP/5900 at the Application Firewall ==="
/usr/libexec/ApplicationFirewall/socketfilterfw --add /System/Library/CoreServices/Screen\ Sharing.app 2>/dev/null
/usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on 2>/dev/null
echo ""
echo "DONE. Evidence preserved in: $EVIDENCE_DIR"
echo "NEXT STEPS: 1) Apply the latest macOS security update from Apple. 2) If TCP/5900 connections from unknown hosts appear in vnc_connections.txt, escalate to IR. 3) Re-enable Screen Sharing ONLY after patching, and only where business-required."