CVE-2026-65400: macOS Screen Sharing Authentication Bypass Under Active Exploitation

CVE-2026-65400 is a critical pre-authentication flaw in macOS Screen Sharing (screensharingd) that allows network attackers to reach an authenticated session without valid credentials; Apple patched the issue on August 6, 2026. The report documents independent reverse engineering that attributes the root cause to authentication state-machine mismanagement, confirms in-the-wild exploitation (including deployment of an XMRig Monero miner), notes public PoCs and active detection guidance, and recommends urgent patching, network restriction of TCP/5900, and forensic investigation of previously exposed hosts.