Apple released security updates on August 6 that address CVE-2026-65400, a flaw in the macOS Screen Sharing service. The Netherlands National Cyber Security Centre (NCSC) reported that attackers exploited the unpatched service to obtain root access and install Monero mining software on affected computers. CISA assigned the vulnerability a CVSS score of 9.8, labeling it critical, after initially rating it lower. Huntress researchers identified tens of thousands of Macs that appeared exposed to the internet, particularly bare-metal systems and hosted Mac minis, before Apple’s patch was applied. The flaw bypasses the Secure Remote Password authentication process used by Screen Sharing, allowing an unauthenticated connection to be treated as authenticated. Changing a Screen Sharing password, disabling legacy VNC authentication, or removing authorized user accounts does not resolve the issue. Apple recommends installing the latest security update or disabling Screen Sharing until the update is applied. The NCSC confirmed active exploitation of the vulnerability on multiple systems with port 5900 exposed to the internet. In the reported cases, attackers gained root control and used the computing resources to mine Monero. The agency has not disclosed the number of compromised machines, the mining pool addresses, the attacker wallets, or the amount of Monero mined. Monero (XMR) was trading near $414 at the time of reporting, with less than a 1 % increase over the previous 24 hours and about a 5 % increase over the past week. The immediate priority is to apply Apple’s patches to all vulnerable macOS versions, including Sonoma 14.8.9, Sequoia 15.7.9, and Tahoe 26.6.1. Further details on the scope of the campaign may be released by incident response teams.