Apple recently released updates to three versions of macOS, stating that they fixed a serious screen sharing vulnerability in macOS Tahoe, Sequoia, and Sonoma.
At the time, there was no indication that the security flaw was being exploited in the wild, but now there is, so if you haven’t yet updated your Mac, you’ll want to do so asap …
Earlier this month, Apple released macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1, with the release notes initially stating only that they provided “important security fixes” and were recommended for all users. The company later expanded on this.
Impact: An attacker on the network may be able to authenticate to Screen Sharing without valid credentials
Description: An authentication issue was addressed with improved state management.
Screen sharing is of course one of the most dangerous features for a security hole, since it potentially allows an attacker to view your screen, open apps and files, and do pretty much anything else they could do if they had physical possession of your logged-in machine.
At the time, Apple said there was no evidence of the vulnerability being exploited in the wild, but that is no longer the case, as Arstechnica reports.
“The Netherlands National Cyber Security Centrum has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” the body warned […]
“In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed.”
As the site notes, the fact that this is being actively exploited raises the prospect of attackers stealing credentials and more. If you are running any of these macOS versions and haven’t yet updated, you should do so immediately.
It’s also best practice to ensure that screen sharing is only enabled when you actively want to use the feature.
Screen sharing can be turned on or off by accessing System Settings > General > Sharing and toggling the switch for Screen Sharing.
It should be disabled immediately after your session ends.
- Certified refurbished Apple products 15% off at apple.com
- Official Apple Store on Amazon
- Discounted AirPods Pro 3
- Wireless CarPlay adapter
- 10-year AirTag battery case
- Logitech MX Master 4 for Mac