Skip to content
fr Sign in
9.8 Critical Exploited

CVE-2026-65400 Apple macOS Improper Authentication Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns Not observed so far
Weakness CWE-287

Description

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

Affected products and versions

Product Affected versions Fixed in
macOS 27 earliest → < 27 27
macOS 26.7 earliest → < 26.7 26.7
macOS 26.6 earliest → < 26.6.1 26.6.1
macOS 15.7 earliest → < 15.7.9 15.7.9
macOS 14.8 earliest → < 14.8.9 14.8.9

References

Timeline

  1. Published
  2. Added to the KEV catalogue
  3. Last modified

Other CVEs of macOS

The 3813 CVEs of macOS →
CVE-2026-86925 An authorization issue was addressed with improved state management 5.5 Medium CVE-2026-84627 A buffer overflow was addressed with improved bounds checking 7.8 High CVE-2026-113945 An out-of-bounds read was addressed with improved bounds checking 5.5 Medium CVE-2026-65327 A logic issue was addressed with improved checks 8.4 High
Track this CVE