From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS

What it is

Huntress's technical breakdown of two macOS Screen Sharing (screensharingd / RFB) vulnerabilities: CVE-2026-43760, a confused-context bug in the privileged file-copy helpers, and CVE-2026-65400, a pre-authentication SRP flaw. Both yield arbitrary file read/write as root over the network. Affected versions include ≤ macOS 26.5.2, ≤ macOS 15.7.7, and ≤ macOS 14.8.7.

How it works

Screen Sharing offers two auth paths: native Apple (username/password, per-user context) and legacy VNC (single shared password). Under legacy VNC, the helpers SSFileCopySender and SSFileCopyReceiver run as root rather than in the user's context — the basis for CVE-2026-43760.

CVE-2026-65400 needs no authentication at all. The daemon's SRP implementation has a frame-length validator that returns a stale success status, so the connection is treated as authenticated and continues without cryptographic protection (cleartext session). It reaches root file operations even with legacy VNC disabled and no local Apple accounts enabled for access.

The file-write primitive is chained to RCE via a LaunchDaemon (triggers a reverse shell on reboot) or a shell startup file such as .zshenv (triggers when Terminal.app opens).

Preconditions / Affected

• Screen Sharing enabled on an unpatched host at or below the versions above.
• Network reachability — the post specifically warns about hosted bare-metal Macs (e.g., on-demand Mac minis) where SSH and Screen Sharing are commonly enabled by default and may face the public internet.
• CVE-2026-65400 requires no credentials and no accounts configured; only the host IP.

What to do

Patch to the fixed macOS releases (Apple's patch landed roughly a week after the late-July security release). Do not expose Screen Sharing to the public internet. You can inspect the helper's dangerous entitlement yourself:

codesign -d --entitlements - /System/Library/CoreServices/RemoteManagement/screensharingd.bundle/Contents/Support/SSFileCopySender.bundle/Contents/MacOS/SSFileCopySender

SSFileCopySender carries the private Apple-signed entitlement kTCCServiceSystemPolicyAllFiles, granting Full Disk Access and bypassing TCC entirely.

Caveats

• The two helpers differ in power: SSFileCopySender has Full Disk Access, but SSFileCopyReceiver has no such entitlement — so write-based bypasses through the Receiver are constrained by TCC.
• Huntress found bl4sty's cron-based RCE (writing to /var/at/tabs/root) failed because that path is TCC-protected; it was later caveated to work only with SIP disabled.
• The LaunchDaemon and shell-startup vectors are offered as alternatives precisely because the cron path is unreliable on default systems.