From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS

This report explains a critical pre-authentication vulnerability in macOS Screen Sharing (CVE-2026-65400) that enables unauthenticated attackers to leverage SSFileCopySender entitlements to read/write files as root and achieve RCE; public PoCs were published, many hosted bare-metal Mac instances are likely exposed, and Apple released patches (macOS 26.6.1, 15.7.9, 14.8.9) with guidance to patch or disable Screen Sharing.