Skip to main content
On August 6, Apple released emergency security updates for a critical vulnerability in macOS Screen Sharing, tracked as CVE-2026-65400. The flaw allows an attacker with network access to a Mac with Screen Sharing enabled to gain access without valid credentials. Apple’s advisory is available here: https://support.apple.com/en-us/148170. Because Screen Sharing is a standard access method for MacStadium-hosted Macs, we have taken a protective step on behalf of all customers: inbound traffic to TCP port 5900 (the default Screen Sharing port) is now blocked at the MacStadium network edge. This immediately removes the attack surface for every hosted Mac, patched or not. To restore access, you have two remediation options: Option 1: Wipe and reinstall (recommended)
Because this vulnerability could allow unauthenticated access, we recommend a full wipe and reinstall of your Mac. First, back up your files via SCP:
Then open a support ticket and ask our support team to wipe and reinstall your machine. Option 2: Self-service update (not recommended unless you’re confident in your security)
You can SSH in yourself, update macOS to a patched version, and reconfigure Screen Sharing on an alternate port using the instructions below. We don’t recommend this path, since your Mac may have already been compromised before the port was blocked. Only choose this option if your Mac was already set to auto-update to a patched version, or if you’re confident it was not accessed by an unauthorized party. The whole process takes about 20 minutes, most of which is the OS update. Before you start, you’ll need:
  • Your Mac’s IP address or hostname
  • Your administrator username and password (available in the MacStadium Portal under your service credentials if you haven’t changed them)
  • An SSH client (built into macOS, Linux, and Windows 10+)
SSH remains fully available. It is unaffected by this vulnerability and by the port block. Step 1: Connect over SSH
From a terminal on your local machine:
Step 2: Update macOS
First, check your current version:
You need to be on one of the following patched versions: macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, or macOS Sonoma 14.8.9. If you’re already there, skip to Step 3.
List available updates:
Find the update label in the output (for example, macOS Tahoe 26.6.1-25G76), then install it. On Apple silicon Macs, installing an OS update over SSH requires you to authenticate as a volume owner, so include your admin username:
Enter your password when prompted. The Mac will download the update, install it, and reboot. This typically takes 10 to 20 minutes. Your SSH session will drop when the reboot begins.
Once the machine is back up, reconnect over SSH and confirm the update landed:
You should see 26.6.1 (build 25G76), 15.7.9, or 14.8.9. Running macOS Ventura or older? Apple has not released a patch for those versions. You’ll need to upgrade to a supported macOS version. Open a support ticket and we’ll help you through it. Step 3: Re-enable Screen Sharing on an alternate port
With your Mac patched, you can safely run Screen Sharing again. Since port 5900 remains blocked at the network edge, you’ll configure it to listen on an alternate port. We’ll use 45900 in this guide, but any unused port works. As a bonus, moving off the default port takes your Mac out of the crosshairs of automated scanners that constantly probe 5900 across the internet.
First, make sure Screen Sharing is enabled:
macOS doesn’t offer a settings toggle for the Screen Sharing port, but you can run the service on a custom port with a copy of Apple’s launch configuration. Run these commands one at a time:
Verify the service is listening on the new port:
You should see screensha in the output. The custom configuration lives in /Library/LaunchDaemons, so it persists across reboots. Step 4: Connect on the new port
From macOS, open Finder, press Cmd+K (Connect to Server), and enter:
From a third-party VNC client, specify port 45900 in the connection settings.
That’s it. You’re patched and your Screen Sharing access is restored. Two things to know going forward: 1) Manage Screen Sharing from the command line. Because the service now runs from the custom configuration, the Screen Sharing toggle in System Settings no longer controls it. To stop it, run sudo launchctl bootout system/com.apple.screensharing.custom; to start it again, re-run the bootstrap command from Step 3. 2) Re-check after future macOS updates. Major OS updates can occasionally reset launch service state. After any future update, run the lsof check from Step 3 to confirm the service is still listening on your custom port, and re-run the bootout/bootstrap commands if it isn’t.
Prefer not to expose Screen Sharing at all?
For the strongest posture, you can skip the custom port entirely and tunnel Screen Sharing through SSH. This keeps the service unreachable from the internet while remaining fully usable:
Leave that session open, then connect your VNC client to vnc://localhost:45900. All Screen Sharing traffic traverses inside the encrypted SSH connection. Customers behind a MacStadium firewall or VPN can also simply continue using Screen Sharing privately, where it was never exposed in the first place.