No Country for Old Passwords
Two pre-auth macOS remote root exploits in four hours
On Thursday August 6, Apple shipped an emergency macOS update. It fixed exactly one vulnerability, CVE-2026-65400, in a feature called Screen Sharing.
Apple does not ship an update out of band unless something is critical. That piqued our curiosity. We started reverse engineering the emergency update and had a working exploit for the bug they fixed about four hours later:
Screen Sharing lets somebody at another computer connect to your Mac, see your screen, and use your computer as though they were sitting at your desk. It is a normal, useful feature that allows you to run a Mac mini in a closet, or fix a Macbook in another building. The researcher who started all this found around 40,000 Macs with Screen Sharing reachable from the Internet.
Signing in takes an account name and password. If a Mac has not taken Thursday's update, anyone who can reach it over the network can skip the password and sign in as you. That kind of bug is called pre-auth, and it's what Apple rushed to fix.
We thought that would be the end of the story, but it got more interesting. We had not fully appreciated the impact. screensharingd, the program answering those connections, runs as root, the account that can do anything, so an attacker did not stop at your account. They could breach every other account on the machine and install whatever they wanted. That makes this, as far as we can tell, the first public macOS remote root exploit in a long time.
Then we learned that it was only the second. screensharingd actually had two critical flaws, not one. @osxreverser found the first one and never told Apple. Then he watched Apple kill it on July 27, while fixing less severe bugs others had reported. Apple has never said whether it knew what it had just fixed, and the first bug never got a CVE.
@osxreverser pointed out, loudly, that his own bug was far more powerful than the ones Apple had announced. That probably sent people back through the same code, where they found the second flaw, and Thursday's emergency release fixed it.
This is the story of what happened. It's a fun illustration of vulnerability research in the age of AI.
How this came out
| Date | Event |
|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Unknown | @osxreverser finds the first bug and does not report it to Apple. |
| before Jul 27 | Alfredo Pesoli of Bynario and others report CVE-2026-43760 to Apple. Other researchers separately report two more Screen Sharing bugs. |
| Mon Jul 27 | macOS 26.6 (25G70) ships. It fixes the reported bugs, and quietly kills the first bug as well. Three "Screen Sharing Server" entries in the security notes, none described as pre-auth. |
| Wed Jul 29 | Bynario publishes a writeup of CVE-2026-43760, a post-auth root command execution, found with GPT-5.5. The same day, @osxreverser publishes "It's a pre-auth, stupid!" with an obfuscated ARM64 Go PoC that downloads arbitrary files as root, and declines to describe the bug. |
| early Aug | @bl4sty publishes a full writeup of @osxreverser's bug, done with AI. |
| Thu Aug 6 | macOS 26.6.1 (25G76), Sequoia 15.7.9 and Sonoma 14.8.9 ship out of band. One entry, CVE-2026-65400, credited to Alfredo Pesoli via Bynario. |
| Sat Aug 8 (APAC) | We start on the 26.6.1 diff, and have a working exploit about four hours later. |The dates above are US Pacific, except ours, since our engineers are in APAC where that Friday was already Saturday.
@osxreverser found the first bug independently and did not report it to Apple. Separately, Alfredo Pesoli of Bynario reported one bug in Screen Sharing, CVE-2026-43760, and other researchers reported two more. Apple fixed all three in 26.6 on July 27. Apple engineers also closed @osxreverser's bug, which has no CVE to this day. The July advisory does not mention that a pre-auth remote root had just been fixed.
On July 29 Bynario published a writeup of their own bug, CVE-2026-43760, and it is real work on a real issue. They found it with an automated workflow driven by GPT-5.5. It needs the password, though, making it post-auth.
That is what set @osxreverser off. The same day, he exclaimed "It's a pre-auth, stupid!", pointing out that the actually cool bug in screensharingd was a reliable pre-auth remote root, and that none of the three advisory entries said so. He released an obfuscated PoC that downloads arbitrary files as root, and declined to explain the mechanism. On August 7 he posted the numbers from a scan he had run some time before:
That number is high because Screen Sharing is the sort of thing that gets switched on in offices, labs, and rack-mounted Mac minis, configured once, and never thought about again.
On August 6, Apple shipped 26.6.1 out of band. The impact line finally says the true thing, that an attacker on the network may be able to authenticate to Screen Sharing without valid credentials. The credit went to Alfredo Pesoli via Bynario, the same name as July.
Two pre-auth remote roots
The bug @osxreverser had been shouting about was already dead when 26.6.1 shipped. 26.6.1 closed a second, independent bug (CVE-2026-65400) sitting in the same source file.
@osxreverser's bug is a single wrong return. A length check bails out early on an oversized frame and hands back a value that happens to be the success code from the read just before it. The caller reads that as "this auth step passed" and advances the state machine.
Where the first bug is a stale return value, the second is a state machine desync. Anybody could probably reproduce it from the patch now, but we are withholding the details until more people have upgraded. There is a second reason we are sitting on this, which will make sense when the time comes.
Naming an account is the one thing the second bug needs, which makes it weaker than the first. It is not much of a barrier. A username is not a secret, and macOS prints them on the login window. The first bug does not even need that.
The second bug was present in 26.5.2 too, sitting next to the first one the whole time.
Both are logic bugs. There is no heap groom, no ASLR defeat, no race to win, no crash. Send one or two packets in the right order and the target Mac machine lets you in. It works the first time and it works every time, on every unpatched machine with Screen Sharing enabled.
Four hours
The 26.6.1 update is small by construction, and the advisory names the subsystem. We pulled the 26.6 and 26.6.1 binaries, diffed them, and built a working exploit against a live 26.6 machine. We then did the same for the first bug, diffing 26.5.2 against 26.6, and had a working exploit for that one too. Two pre-auth remote root exploits in four hours, on and off, across a busy weekend.
Everyone in this story except @osxreverser was running a model. Bynario found their bug with GPT-5.5. Two of the credits on the July advisory are automated systems, Atuin's discovery engine and Tencent Xuanwu's XlabAI team. bl4sty wrote up the first bug with AI too.
AI is getting better at finding new bugs, and it is getting better just as fast at recovering old ones from the patches. The gap between "patched" and "weaponized" is collapsing, as we warned earlier this year.
Recommendations
Update to 26.6.1, 15.7.9, or 14.8.9. Best to turn Screen Sharing off. If you need it on, put it behind a VPN or a firewall rule.
If you run a fleet, go and check how many of your machines have this enabled. Our guess is that the number will surprise you, because it surprised us.