{"schema":"vulnpedia.research/1","cve":"CVE-2026-65400","references":[{"url":"https://support.apple.com/en-us/148170","tags":["Release Notes","Vendor Advisory"],"source":"mitre","sourceId":"apple","modified":"2026-09-14T20:48:37.949Z","origins":[{"source":"mitre","sourceId":"apple","modified":"2026-09-14T20:48:37.949Z","url":"https://support.apple.com/en-us/148170"},{"source":"nvd","sourceId":"CVE-2026-65400","modified":"2026-10-24T16:10:00.153","url":"https://support.apple.com/en-us/148170"}]},{"url":"https://support.apple.com/en-us/148171","tags":["Release Notes","Vendor Advisory"],"source":"mitre","sourceId":"apple","modified":"2026-09-14T20:48:37.949Z","origins":[{"source":"mitre","sourceId":"apple","modified":"2026-09-14T20:48:37.949Z","url":"https://support.apple.com/en-us/148171"},{"source":"nvd","sourceId":"CVE-2026-65400","modified":"2026-10-24T16:10:00.153","url":"https://support.apple.com/en-us/148171"}]},{"url":"https://support.apple.com/en-us/148172","tags":["Release Notes","Vendor Advisory"],"source":"mitre","sourceId":"apple","modified":"2026-09-14T20:48:37.949Z","origins":[{"source":"mitre","sourceId":"apple","modified":"2026-09-14T20:48:37.949Z","url":"https://support.apple.com/en-us/148172"},{"source":"nvd","sourceId":"CVE-2026-65400","modified":"2026-10-24T16:10:00.153","url":"https://support.apple.com/en-us/148172"}]},{"url":"https://support.apple.com/en-us/149035","tags":["Release Notes","Vendor Advisory"],"source":"mitre","sourceId":"apple","modified":"2026-09-14T20:48:37.949Z","origins":[{"source":"mitre","sourceId":"apple","modified":"2026-09-14T20:48:37.949Z","url":"https://support.apple.com/en-us/149035"},{"source":"nvd","sourceId":"CVE-2026-65400","modified":"2026-10-24T16:10:00.153","url":"https://support.apple.com/en-us/149035"}]},{"url":"https://support.apple.com/en-us/149042","tags":["Release Notes","Vendor Advisory"],"source":"mitre","sourceId":"apple","modified":"2026-09-14T20:48:37.949Z","origins":[{"source":"mitre","sourceId":"apple","modified":"2026-09-14T20:48:37.949Z","url":"https://support.apple.com/en-us/149042"},{"source":"nvd","sourceId":"CVE-2026-65400","modified":"2026-10-24T16:10:00.153","url":"https://support.apple.com/en-us/149042"}]},{"url":"https://advisories.ncsc.nl/2026/ncsc-2026-0280.html","tags":["third-party-advisory","Third Party Advisory","KEV report"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-19T03:55:50.505Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-19T03:55:50.505Z","url":"https://advisories.ncsc.nl/2026/ncsc-2026-0280.html"},{"source":"nvd","sourceId":"CVE-2026-65400","modified":"2026-10-24T16:10:00.153","url":"https://advisories.ncsc.nl/2026/ncsc-2026-0280.html"},{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","url":"https://advisories.ncsc.nl/2026/ncsc-2026-0280.html"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-19T03:55:50.505Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-19T03:55:50.505Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400"},{"source":"nvd","sourceId":"CVE-2026-65400","modified":"2026-10-24T16:10:00.153","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400"}]},{"url":"http://seclists.org/fulldisclosure/2026/Aug/36","tags":["Mailing List"],"source":"mitre","sourceId":"CVE","modified":"2026-08-13T23:15:32.774Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-08-13T23:15:32.774Z","url":"http://seclists.org/fulldisclosure/2026/Aug/36"},{"source":"nvd","sourceId":"CVE-2026-65400","modified":"2026-10-24T16:10:00.153","url":"http://seclists.org/fulldisclosure/2026/Aug/36"}]},{"url":"http://seclists.org/fulldisclosure/2026/Aug/37","tags":["Broken Link"],"source":"mitre","sourceId":"CVE","modified":"2026-08-13T23:15:32.774Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-08-13T23:15:32.774Z","url":"http://seclists.org/fulldisclosure/2026/Aug/37"},{"source":"nvd","sourceId":"CVE-2026-65400","modified":"2026-10-24T16:10:00.153","url":"http://seclists.org/fulldisclosure/2026/Aug/37"}]},{"source":"euvd","sourceId":"EUVD-2026-54216","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54216","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-54216","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54216"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://www.ncsc.nl/alerts/kwetsbaarheid-in-macos-screen-sharing","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","url":"https://www.ncsc.nl/alerts/kwetsbaarheid-in-macos-screen-sharing"}]},{"url":"https://previdian.com/CVE-2026-65400","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","url":"https://previdian.com/CVE-2026-65400"}]},{"url":"https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","url":"https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://www.iru.com/blog/inside-the-screensharingd-bugs-how-macos-screen-sharing-went-from-root-file-access-to-pre-auth-compromise","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","url":"https://www.iru.com/blog/inside-the-screensharingd-bugs-how-macos-screen-sharing-went-from-root-file-access-to-pre-auth-compromise"}]},{"url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/"}]},{"url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]},{"url":"https://vulncheck.com/xdb/8c7df89c30ab","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"8c7df89c30ab","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"8c7df89c30ab","modified":"2026-08-07T00:00:00Z","url":"https://vulncheck.com/xdb/8c7df89c30ab"}]},{"url":"https://github.com/acheong08/CVE-2026-65400","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"8c7df89c30ab","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"8c7df89c30ab","modified":"2026-08-07T00:00:00Z","url":"https://github.com/acheong08/CVE-2026-65400"}]},{"url":"https://vulncheck.com/xdb/039963a509be","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"039963a509be","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"039963a509be","modified":"2026-08-07T00:00:00Z","url":"https://vulncheck.com/xdb/039963a509be"}]},{"url":"https://github.com/panchocosil/CVE-2026-65400-poc","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"039963a509be","modified":"2026-08-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"039963a509be","modified":"2026-08-07T00:00:00Z","url":"https://github.com/panchocosil/CVE-2026-65400-poc"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/HORKimhab/CVE-2026-65400","source":"poc-in-github","sourceId":"CVE-2026-65400","description":"CVE-2026-65400","modified":"2026-09-16T02:01:12Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-65400","url":"https://github.com/HORKimhab/CVE-2026-65400"},{"source":"poc-in-github","sourceId":"CVE-2026-65400","modified":"2026-09-16T02:01:12Z","url":"https://github.com/HORKimhab/CVE-2026-65400"}],"tags":[]},{"url":"https://github.com/panchocosil/CVE-2026-65400-poc","source":"poc-in-github","sourceId":"CVE-2026-65400","description":"Read-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.","modified":"2026-10-20T21:43:36Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-65400","url":"https://github.com/panchocosil/CVE-2026-65400-poc"},{"source":"poc-in-github","sourceId":"CVE-2026-65400","modified":"2026-10-20T21:43:36Z","url":"https://github.com/panchocosil/CVE-2026-65400-poc"}],"tags":[]},{"url":"https://github.com/acheong08/CVE-2026-65400","source":"poc-in-github","sourceId":"CVE-2026-65400","description":"Apple MacOS Screen Sharing Arbitrary File read/write -> RCE","modified":"2026-10-24T04:11:14Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-65400","url":"https://github.com/acheong08/CVE-2026-65400"},{"source":"poc-in-github","sourceId":"CVE-2026-65400","modified":"2026-10-24T04:11:14Z","url":"https://github.com/acheong08/CVE-2026-65400"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"8c7df89c30ab","url":"https://vulncheck.com/xdb/8c7df89c30ab","cve":"CVE-2026-65400","dateAdded":"2026-08-22T08:54:26Z","modified":"2026-08-07T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/acheong08/CVE-2026-65400","observations":[{"dateAdded":"2026-08-22T08:54:26Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"8c7df89c30ab","modified":"2026-08-07T00:00:00Z","url":"https://vulncheck.com/xdb/8c7df89c30ab"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"039963a509be","url":"https://vulncheck.com/xdb/039963a509be","cve":"CVE-2026-65400","dateAdded":"2026-08-24T06:13:56Z","modified":"2026-08-07T00:00:00Z","exploitType":"info-leak","repositoryUrl":"https://github.com/panchocosil/CVE-2026-65400-poc","observations":[{"dateAdded":"2026-08-24T06:13:56Z","exploitType":"info-leak"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"039963a509be","modified":"2026-08-07T00:00:00Z","url":"https://vulncheck.com/xdb/039963a509be"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-08-07T00:00:00Z","modified":"2026-08-07T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Apple","product":"MacOS X","dueDate":"2026-08-21T00:00:00Z","cisaDateAdded":"2026-08-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","modified":"2026-08-07T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","catalog":"VulnCheck KEV","kind":"report","url":"https://www.ncsc.nl/alerts/kwetsbaarheid-in-macos-screen-sharing","dateAdded":"2026-08-07T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","url":"https://www.ncsc.nl/alerts/kwetsbaarheid-in-macos-screen-sharing"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","catalog":"VulnCheck KEV","kind":"report","url":"https://advisories.ncsc.nl/2026/ncsc-2026-0280.html","dateAdded":"2026-08-12T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","url":"https://advisories.ncsc.nl/2026/ncsc-2026-0280.html"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","catalog":"VulnCheck KEV","kind":"report","url":"https://previdian.com/CVE-2026-65400","dateAdded":"2026-08-15T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","url":"https://previdian.com/CVE-2026-65400"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","catalog":"VulnCheck KEV","kind":"report","url":"https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/","dateAdded":"2026-08-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","url":"https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","dateAdded":"2026-08-18T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","catalog":"VulnCheck KEV","kind":"report","url":"https://www.iru.com/blog/inside-the-screensharingd-bugs-how-macos-screen-sharing-went-from-root-file-access-to-pre-auth-compromise","dateAdded":"2026-09-01T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","url":"https://www.iru.com/blog/inside-the-screensharingd-bugs-how-macos-screen-sharing-went-from-root-file-access-to-pre-auth-compromise"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","catalog":"VulnCheck KEV","kind":"report","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/","dateAdded":"2026-09-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","dateAdded":"2026-09-08T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-65400","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]}]}