EUVD-2026-54216
GHSA-cwph-f4w9-f4wq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable Screen Sharing service, no credentials or interaction needed (AV:N/AC:L/PR:N/UI:N), and a successful bypass yields full interactive control, so C:H/I:H/A:H.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
10DescriptionCVE.org
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
Articles & Coverage 1
AnalysisAI
Authentication bypass in Apple's macOS Screen Sharing service allows a network-adjacent attacker to establish a Screen Sharing session without supplying valid credentials, granting interactive remote control of the target Mac. The flaw affects macOS Sequoia before 15.7.9, macOS Sonoma before 14.8.9, and macOS Tahoe before 26.6.1, and was reported by Apple Product Security itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target Mac must have the Screen Sharing (or Remote Management/Apple Remote Desktop) service enabled and network-reachable by the attacker - this service is OFF by default on macOS, which is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are unusually split. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, or macOS Tahoe 26.6.1, whichever matches the installed train, per Apple's advisories at https://support.apple.com/en-us/148170, https://support.apple.com/en-us/148171, and https://support.apple.com/en-us/148172. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all macOS systems and identify those running Sequoia (before 15.7.9), Sonoma (before 14.8.9), or Tahoe (before 26.6.1); disable Screen Sharing on non-essential systems as interim control. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today