Critical macOS Screen Sharing Bug Gives Attackers Root Access. Update to macOS 26.6 Now.

Summary

A security researcher publicly disclosed a pre-authentication vulnerability in macOS Screen Sharing this week that allows an attacker on the same network to gain complete root access to a Mac without a password and with no user interaction required. The flaw sits in the screensharingd background daemon, which mishandles oversized data frames by returning a stale success code instead of an error. Apple fixed the vulnerability in macOS 26.6, which was released on July 27. Any Mac running macOS 26.5 or earlier with Screen Sharing enabled is exposed.

Why it matters

The public disclosure means the vulnerability is now widely known. If you have Screen Sharing enabled and have not updated to macOS 26.6 yet, a public network or even a home network shared with compromised devices is enough for an attacker to exploit this. Disabling Screen Sharing in System Settings is the interim mitigation if you cannot update right away.

HTD Says

This one is simple: if your Mac is running anything earlier than macOS 26.6, someone on your network could take control of it via Screen Sharing without needing your password. Go update now, or at least turn off Screen Sharing in System Settings until you can.

I nag my family to always update their devices (mainly because if they don’t, I’m the one who has to get them out of tech trouble). And I always advise my friends and colleagues to do the same. I tend to sound like a broken record at times, but when it comes to security updates, phishing scams, and other hacks, you simply cannot be too careful.

The problem is that operating systems are getting incredibly complicated, with many new features and settings buried across multiple preference screens. Also, AI, while helpful, is exposing security vulnerabilities at a much faster rate, including those that have not been known for years. So, buckle up; I’m sure there are many more like this coming.

Source:

Cyber Kendra