What you need to know
On August 6, Apple released emergency security updates for a critical vulnerability in macOS Screen Sharing, tracked as CVE-2026-65400. The flaw allows an attacker with network access to a Mac with Screen Sharing enabled to gain access without valid credentials. Apple’s advisory is available here: https://support.apple.com/en-us/148170. Because Remote Management and Screen Sharing are commonly used access methods for MacStadium-hosted Macs, we have taken a protective step on behalf of all customers: inbound traffic to TCP port 5900 (the default Screen Sharing port) is now blocked at the MacStadium network edge. This immediately removes the attack surface for every hosted Mac, patched or not. Users are encouraged to use an SSH tunnel to access their Macs instead of connecting directly to the Screen Sharing port. This will allow you to connect to your Mac even with the inbound traffic on port 5900 blocked. If your Mac was running an affected version and Screen Sharing was reachable from an untrusted network before the port was blocked, we recommend rebuilding the Mac from a known-good state rather than assuming it was not compromised. If Screen Sharing was never enabled, was reachable only from trusted networks (a private network, VPN, or a public-IP Mac restricted by a MacStadium firewall / IP allow-list), or your Mac was already patched, your exposure is substantially different. In those cases, patching macOS is the primary remediation.Do not expose Screen Sharing directly to the Internet on an alternate port as a workaround. If you need Screen Sharing access from an untrusted network, use an SSH tunnel or VPN/private network instead.
What MacStadium has done
MacStadium has blocked inbound TCP port 5900 at the network edge for hosted Macs. This provides an additional layer of protection while customers patch or rebuild their systems. SSH remains available and is unaffected by this vulnerability and the port block.Do I need to rebuild my Mac?
Use the following guidance:
The network block prevents further access through TCP 5900, but it does not establish whether a Mac was accessed before the block was implemented.
Recommended remediation: Wipe and rebuild the Mac
If your Mac was potentially exposed while running an affected version, the safest approach is to rebuild it from a known-good state.Step 1. Back up required data
Back up the files you need to retain before requesting the rebuild. For example:Step 2. Open a MacStadium Support ticket
Ask MacStadium Support to wipe and reinstall the machine. Support can help with the rebuild and getting the Mac back into service.Alternative: Self-service patching
If you have high confidence that your Mac was not exposed or accessed before the network block, you can patch the Mac yourself. This option is appropriate, for example, if:- Screen Sharing was never publicly reachable;
- the Mac was protected by a firewall or VPN;
- the Mac was already patched; or
- you have another reliable reason to establish that the vulnerable service was not exposed.
Before you start
You will need:- Your Mac’s IP address or hostname
- Your administrator username and password
- An SSH client
Step 1: Connect over SSH
From a terminal on your local machine:Step 2: Update macOS
First, check your current version:- macOS Tahoe 26.6.1
- macOS Sequoia 15.7.9
- macOS Sonoma 14.8.9
Running macOS Ventura or older?
Apple has not released a patch for those versions. Open a MacStadium Support ticket for assistance upgrading to a supported macOS version.Restoring Screen Sharing access
After patching, we recommend keeping Screen Sharing inaccessible from the public Internet. There are two preferred approaches.Option 1: Use an SSH tunnel
SSH tunneling allows you to use Screen Sharing without exposing the Screen Sharing service to the Internet. First, make sure Screen Sharing is enabled on the Mac. You can enable it in either of two ways:- In the macOS interface, go to System Settings > General > Sharing and turn on Screen Sharing.
- From the command line, connect to the Mac over SSH and run: