Hackers are targeting Macs through an Apple Screen Sharing vulnerability, with attacks now confirmed in the wild

Hackers are exploiting a Mac Screen Sharing flaw to access systems, prompting Apple to issue fixes and urge users to disable the feature or update.

Mac users face a serious security threat that could allow attackers to access their computers via Apple’s Screen Sharing tool. The vulnerability was initially treated as a precautionary concern, as there was no evidence it had been exploited when Apple first addressed it. That has now changed, with Dutch authorities confirming (Via Engadget) that the flaw has been used to attack multiple systems. Apple has since released security updates for the affected versions of macOS. Here is what the vulnerability means, which Macs are affected and what users can do to stay protected.

Screen Sharing flaw can give attackers extensive access

Apple patches a Screen Sharing flaw now being exploited, urging Mac users to update and secure vulnerable systems. (Bloomberg)

The vulnerability affects Apple’s Screen Sharing tool and could allow an attacker on the network to authenticate without valid credentials. In practical terms, this means an attacker could gain access to a Mac without the correct login information.

Once inside, the consequences can be serious. The vulnerability can allow attackers to view the victim’s screen, open files, and interact with the computer. The level of access can effectively give an attacker control similar to physical possession of the Mac.

The vulnerability becomes even more concerning when attackers gain root access. This gives them extensive privileges across the system and allows them to carry out additional malicious activity. In the attacks reported in the Netherlands, attackers used that access to upload crypto-mining software onto affected systems.

Apple has released security updates for affected Macs

That situation has now changed. The Netherlands National Cyber Security Centrum has warned that it has received notifications that the vulnerability is being exploited on multiple systems. Apple’s latest updates address the issue across three macOS versions.

The newest releases are macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. Apple’s security notes say the vulnerability could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.

The updates also arrived without going through the usual developer and public beta testing phases. That suggests Apple considered the security issue significant enough to warrant an immediate fix rather than waiting for the normal release cycle.

What Mac users can do to stay protected

Installing the latest macOS security update is the most important step for users running an affected version. The vulnerability may have initially seemed theoretical, but confirmed attacks mean an unpatched Mac now faces a more immediate risk.

Users can also disable Apple’s Screen Sharing feature if they do not need it. The option is available in System Settings and removes Screen Sharing as a potential attack vector.

Another important precaution concerns port 5900, which is associated with Screen Sharing. Security experts recommend keeping the port closed, particularly when Screen Sharing is enabled, because the vulnerability is being exploited when the port is exposed to the Internet.

For Mac users, the message is straightforward: update the operating system, disable Screen Sharing if it is not needed, and avoid exposing port 5900 to the internet. A vulnerability that once looked like a precautionary concern has now become a real-world security threat.