What you need to know
On August 6, Apple released emergency security updates for a critical vulnerability in macOS Screen Sharing, tracked as CVE-2026-65400. The flaw allows an attacker with network access to a Mac with Screen Sharing enabled to gain access without valid credentials. Apple’s advisory is available here: https://support.apple.com/en-us/148170. Because Remote Management and Screen Sharing are commonly used access methods for MacStadium-hosted Macs, we have taken a protective step on behalf of all customers: inbound traffic to TCP port 5900 (the default Screen Sharing port) is now blocked at the MacStadium network edge. This immediately removes the attack surface for every hosted Mac, patched or not. Users are encouraged to use an SSH tunnel to access their Macs instead of connecting directly to the Screen Sharing port. This will allow you to connect to your Mac even with the inbound traffic on port 5900 blocked. If your Mac was running an affected version and Screen Sharing was reachable from an untrusted network before the port was blocked, we recommend rebuilding the Mac from a known-good state rather than assuming it was not compromised. If Screen Sharing was never enabled, was reachable only from trusted networks (a private network, VPN, or a public-IP Mac restricted by a MacStadium firewall / IP allow-list), or your Mac was already patched, your exposure is substantially different. In those cases, patching macOS is the primary remediation.Do not expose Screen Sharing directly to the Internet on an alternate port as a workaround. If you need Screen Sharing access from an untrusted network, use an SSH tunnel or VPN/private network instead.
What MacStadium has done
MacStadium has blocked inbound TCP port 5900 at the network edge for hosted Macs. This provides an additional layer of protection while customers patch or rebuild their systems. SSH remains available and is unaffected by this vulnerability and the port block.Do I need to rebuild my Mac?
Use the following guidance:
The network block prevents further access through TCP 5900, but it does not establish whether a Mac was accessed before the block was implemented.
Recommended remediation: Wipe and rebuild the Mac
If your Mac was potentially exposed while running an affected version, the safest approach is to rebuild it from a known-good state.Step 1. Back up required data
Back up the files you need to retain before requesting the rebuild. For example:Step 2. Open a MacStadium Support ticket
Ask MacStadium Support to wipe and reinstall the machine. Support can help with the rebuild and getting the Mac back into service.Alternative: Self-service patching
If you have high confidence that your Mac was not exposed or accessed before the network block, you can patch the Mac yourself. This option is appropriate, for example, if:- Screen Sharing was never publicly reachable;
- the Mac was protected by a firewall or VPN;
- the Mac was already patched; or
- you have another reliable reason to establish that the vulnerable service was not exposed.
Before you start
You will need:- Your Mac’s IP address or hostname
- Your administrator username and password
- An SSH client
Step 1: Connect over SSH
From a terminal on your local machine:Step 2: Update macOS
First, check your current version:- macOS Tahoe 26.6.1
- macOS Sequoia 15.7.9
- macOS Sonoma 14.8.9