CVE-2026-65400 — macOS Screen Sharing pre-auth root file read (read-only PoC)

Read-only proof of concept. It demonstrates the authentication bypass by reading a root-only file from a vulnerable host. It writes nothing to the target: no LaunchDaemon, no shell startup file, no crontab, no RCE chain.

Run against a Mac I own (macOS Tahoe 26.5.2, unpatched). Serial number redacted.

Summary

screensharingd — the daemon behind macOS Screen Sharing / Apple Remote Management (TCP 5900) — can be tricked into treating an unauthenticated connection as authenticated. No username, no password, no interaction on the target.

The daemon's native authentication path uses SRP (Secure Remote Password). Its frame-length validator returns a stale success status, so the connection is marked authenticated before any credential has been proven. Apple's advisory language — "improved state management" — matches this: the cryptography was never broken, the state machine around it was.

Once past that gate the session continues in cleartext, and the privileged file-copy helpers (SSFileCopySender / SSFileCopyReceiver) hold Full Disk Access. That yields pre-auth arbitrary file read and write as root, bypassing TCC — and from there, remote code execution is one LaunchDaemon or shell startup file away.

Pre-auth. Remote. Root. Default configuration, the moment Screen Sharing is enabled.

Affected versions

Requires Screen Sharing / Remote Management to be enabled and reachable. Hardening the accounts does not help — removing users, disabling legacy VNC and rotating passwords provide no protection, because the bug is reached before authentication.

Exploitation status

This is not theoretical. It is being exploited in the wild.

Observed in-the-wild activity against internet-exposed port 5900: SSH public key dropped for persistence, logs and shell history cleared, packet filter rules modified, and the XMRig 6.26.0 Monero miner deployed.

Usage

Python 3, standard library only. No dependencies.

python3 poc_screensharing.py <IP>                          # reads /etc/sudoers
python3 poc_screensharing.py <IP> /etc/passwd
python3 poc_screensharing.py <IP> /etc/master.passwd -r 50

-p, --port      target port (default 5900)
-u, --user      username sent in the SRP step-1 frame (default root)
-r, --retries   retry count (default 25) — the bug is heap-racy
-t, --timeout   socket timeout in seconds (default 8.0)

Notes on reliability

• The bug is racy. It depends on heap layout and does not land on every attempt; that is why the PoC retries. If it does not land in 25–50 tries, try again later.
• The daemon throttles. Hammering it gets you rate-limited — wait ~1 minute.
• Patched hosts are detected, not retried. A SecurityResult != 0 or a security-type list without SRP (36) stops the loop and reports the host as not vulnerable.

Detection

Endpoint Security event ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH:

• authentication_type: SRP without an RSA component — legitimate sessions report RSA-SRP. This is the highest-signal indicator.
• Session username root — the account is disabled by default on macOS.
• SSFileCopySender running with UID/GID 0 80, touching system paths via _LOOKUP / _OPEN / _STAT / _CLOSE during a Screen Sharing session.

Mitigation

1. Patch to 26.6.1 / 15.7.9 / 14.8.9. This is the only real fix.
2. If you cannot patch, disable Screen Sharing / Remote Management entirely.
3. Never expose TCP 5900 to the internet — with or without this CVE.

Credits

The research is not mine. This repository is a reproduction and a write-up.

• Pedro Vilaça (fG!, @osxreverser) — original pre-auth bug
• bl4sty (navi_the_clown) — wire format and exploitation technique
• bynar.io — CVE-2026-43760
• Huntress (Bryan Masters, Stuart Ashenbrenner) — detection guidance

Legal

For authorized security testing, defensive validation and education only. Run it against systems you own or have explicit written permission to test. The screenshot above is a Mac I own. Using this against systems you do not control is illegal in most jurisdictions. The author accepts no liability for misuse.

Released only after the vendor patch was publicly available, and deliberately limited to a read primitive.

Español

screensharingd, el demonio de Compartir Pantalla de macOS (TCP 5900), puede darse por autenticado sin que nadie haya presentado credenciales. Su validador de longitud de frame en el flujo SRP devuelve un estado de éxito obsoleto, así que la conexión se trata como autenticada antes de tiempo. Apple lo describe como "improved state management": la criptografía nunca se rompió, se rompió la máquina de estados que la rodea.

A partir de ahí la sesión continúa en claro y los helpers privilegiados de copia de ficheros (SSFileCopySender / SSFileCopyReceiver) tienen Full Disk Access, lo que da lectura y escritura arbitraria como root saltándose TCC — y de ahí a RCE hay un LaunchDaemon de distancia. Pre-auth, remoto, root y en configuración por defecto.

Este PoC es de solo lectura: demuestra el bypass leyendo un fichero que solo root puede leer y no escribe nada en el objetivo.

Qué hacer: actualizar a 26.6.1 / 15.7.9 / 14.8.9 — es el único arreglo real. Si no puedes, desactiva Compartir Pantalla. Rotar contraseñas o eliminar cuentas no sirve, porque el fallo se alcanza antes de la autenticación. Y que el 5900 no esté expuesto a Internet.

Úsalo solo contra equipos de tu propiedad o con autorización por escrito.