CVE-2026-65400 is a Screen Sharing authentication bypass affecting macOS Sequoia, Sonoma, and Tahoe, carrying a CVSS of 7.1. The patch language references 'improved state management' — Apple's standard phrasing for authentication state machine flaws in distributed protocol handlers. While the exact technical flaw isn't public, the structural characteristics tell you enough to act.
Screen Sharing listens on port 5900 and is commonly enabled for remote support. The vulnerability is pre-authentication and exploitable by an attacker who can send packets to the target — no credentials required. This puts it in a more dangerous category than a typical local privilege escalation: the attack surface is your network, and the impact isn't just screen visibility but input capability, meaning an attacker with this access has achieved persistence that survives credential rotation and often evades detection because it manifests as 'legitimate' remote access.
Here's what matters: Screen Sharing is VNC under the hood. The RFB protocol's authentication state machine was deprecated by its own maintainers over a decade ago because it has well-documented failure modes around state confusion during connection negotiation. Apple wrapped their own consent layer on top, but the underlying protocol machinery remains. This CVE likely represents Apple finally encountering one of those documented VNC state machine flaws in their production code — late, because they inherited this stack from legacy remote access tooling they never fully rewrote.
The CVSS 7.1 feels conservative. Pre-auth network access to a commonly-enabled service with screen-plus-input capability should score higher. Apple historically rates their own remote access primitives conservatively. If you're prioritizing, treat this as higher-severity than the score suggests.
For defenders: disable Screen Sharing if you don't need it. If you do need it, restrict access to port 5900 to specific management subnets only — do not expose it broadly. Monitor for unexpected Screen Sharing sessions, particularly those initiated during what should be idle periods. The consent dialog is not a safeguard here; an attacker who corrupts the state machine during negotiation can establish access before the dialog appears, making the user a willing accomplice to their own compromise.