CVE-2026-65400: listed in the CISA KEV catalog

CVE-2026-65400 · CVSS 7.1 HIGH · KEV 2026-08-18 · patch available

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

Is CVE-2026-65400 exploited?

• Listed in the CISA KEV catalog on 2026-08-18.
• Federal remediation due 2026-08-21.
• Past that date by 41 days.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Apple · iOS · <27
• Apple · macOS · Golden Gate <27
• Apple · iPadOS · <27
• Apple · iOS · <26.7
• Apple · Safari · <27
• Apple · iPadOS · <26.7
• Apple · macOS · Sequoia <15.8
• Apple · macOS · Tahoe <26.7

Is there a patch?

• iOS 27
• macOS Golden Gate 27
• iPadOS 27
• iOS 26.7
• Safari 27
• iPadOS 26.7
• macOS Sequoia 15.8
• macOS Tahoe 26.7

What PlainSec published about CVE-2026-65400

• CISA’s KEV Update Spans Four Live Exploits (2026-08-17)
• Screen Sharing Bypass Lets Attackers Log In Without Credentials (2026-08-08)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No EPSS score.

KEV and EPSS are re-checked daily. Record last updated 2026-08-24.