> ## Documentation Index > Fetch the complete documentation index at: https://docs.macstadium.com/llms.txt > Use this file to discover all available pages before exploring further. # Update regarding CVE-2026-65400 ## What you need to know On August 6, Apple released emergency security updates for a critical vulnerability in macOS Screen Sharing, tracked as CVE-2026-65400. The flaw allows an attacker with network access to a Mac with Screen Sharing enabled to gain access without valid credentials. Apple’s advisory is available here: **[https://support.apple.com/en-us/148170](https://support.apple.com/en-us/148170).** Because Screen Sharing is a standard access method for MacStadium-hosted Macs, we have taken a protective step on behalf of all customers: **inbound traffic to TCP port 5900 (the default Screen Sharing port) is now blocked at the MacStadium network edge.** This immediately removes the attack surface for every hosted Mac, patched or not. **If your Mac was running an affected version and Screen Sharing was reachable from an untrusted network before the port was blocked, we recommend rebuilding the Mac from a known-good state rather than assuming it was not compromised.** If Screen Sharing was never enabled, was only accessible through a private network or VPN, or your Mac was already patched, your exposure is substantially different. In those cases, patching macOS is the primary remediation. > **Do not expose Screen Sharing directly to the Internet on an alternate port as a workaround.** If you need Screen Sharing access from an untrusted network, use an SSH tunnel or VPN/private network instead. ## What MacStadium has done MacStadium has blocked inbound **TCP port 5900** at the network edge for hosted Macs. This provides an additional layer of protection while customers patch or rebuild their systems. SSH remains available and is unaffected by this vulnerability and the port block. ## Do I need to rebuild my Mac? Use the following guidance: | Scenario | Recommended action | | :-------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------ | | Screen Sharing was never enabled | Patch macOS | | Screen Sharing was only accessible through a private network or VPN | Patch macOS; rebuilding is generally unnecessary | | Screen Sharing was reachable from the public Internet while the Mac was running an affected version | **Contact support and rebuild** | | You are unsure whether Screen Sharing was publicly reachable | **Treat the Mac as potentially exposed and contact MacStadium Support for a rebuild** | | You have evidence of unauthorized access | **Rotate credentials/secrets, contact support, and rebuild.** | The network block prevents further access through TCP 5900, but **it does not establish whether a Mac was accessed before the block was implemented.** ## Recommended remediation: Wipe and rebuild the Mac If your Mac was potentially exposed while running an affected version, the safest approach is to rebuild it from a known-good state. #### Step 1. Back up required data: Back up the files you need to retain before requesting the rebuild. For example: ```text theme={null} scp username@remote_host:/path/to/remote/file.txt /path/to/local/destination/ ``` *Do not restore the entire system from a potentially compromised Mac.* Avoid restoring system files, applications, launch agents, scripts, or other executable/configuration content unless you have verified it is trusted. #### Step 2. Open a MacStadium Support ticket Ask MacStadium Support to wipe and reinstall the machine. Support can help with the rebuild and getting the Mac back into service. ## Alternative: Self-service patching If you have high confidence that your Mac was **not exposed or accessed before the network block**, you can patch the Mac yourself. This option is appropriate, for example, if: * Screen Sharing was never publicly reachable; * the Mac was protected by a firewall or VPN; * the Mac was already patched; or * you have another reliable reason to establish that the vulnerable service was not exposed. If you are uncertain, we recommend rebuilding instead. #### Before you start You will need: * Your Mac's IP address or hostname * Your administrator username and password * An SSH client #### Step 1: Connect over SSH From a terminal on your local machine: ```text theme={null} ssh youradminuser@your.server.ip.address ``` #### Step 2: Update macOS First, check your current version: ```text theme={null} sw_vers ``` Apple has released fixes for the following versions: * **macOS Tahoe 26.6.1** * **macOS Sequoia 15.7.9** * **macOS Sonoma 14.8.9** If you are already running one of these versions, no OS update is required. List available updates: ```text theme={null} softwareupdate --list ``` Find the appropriate update in the output and install it. For example: ```text theme={null} sudo softwareupdate --install "macOS Tahoe 26.6.1-25G76" --restart --agree-to-license --user youradminuser --stdinpass ``` Enter your password when prompted. The Mac will download and install the update and then reboot. Your SSH session will disconnect when the reboot begins. Once the machine is back up, reconnect over SSH and confirm the version: ```text theme={null} sw_vers ``` You should see a patched version such as 26.6.1, 15.7.9, or 14.8.9. ### Running macOS Ventura or older? Apple has not released a patch for those versions. Open a MacStadium Support ticket for assistance upgrading to a supported macOS version. ## Restoring Screen Sharing access After patching, **we recommend keeping Screen Sharing inaccessible from the public Internet.** There are two preferred approaches. #### Option 1: Use an SSH tunnel SSH tunneling allows you to use Screen Sharing without exposing the Screen Sharing service to the Internet. First, make sure Screen Sharing is enabled on the Mac. Then, from your local computer, create an SSH tunnel: ```text theme={null} ssh -L 45900:127.0.0.1:5900 youradminuser@your.server.ip.address ``` Leave this SSH session open. Then connect your VNC client to: ```text theme={null} vnc://localhost:45900 ``` The Screen Sharing traffic is carried through the encrypted SSH connection, while port 5900 remains inaccessible from the Internet. #### Option 2: Use a private network or VPN Customers using a MacStadium firewall, VPN, or other private connectivity can continue to use Screen Sharing over that private connection. This is the preferred approach for customers who need persistent remote Screen Sharing access. Restrict Screen Sharing so that it is accessible only from trusted networks whenever possible. ## What we do not recommend **Do not expose Screen Sharing directly to the Internet simply by moving it to another port.** Changing TCP 5900 to another port can reduce exposure to unsophisticated scanners, but it is not a meaningful security control. An attacker can discover services running on non-standard ports. For this reason, MacStadium does **not** recommend configuring Screen Sharing to listen on an alternate publicly accessible port as a remediation for CVE-2026-65400. Use an SSH tunnel, VPN, firewall, or other private-network control instead. ## Frequently asked questions #### Does blocking port 5900 fix the vulnerability? Blocking TCP 5900 prevents the known network attack path through the default Screen Sharing port. However, it does not patch macOS and does not determine whether a Mac was accessed before the block. You should still install Apple's security update. #### Do I need to rebuild every Mac? No. Rebuilding is primarily recommended for Macs that may have been exposed to an untrusted network while running an affected version. If Screen Sharing was never enabled, was protected by a private network or VPN, or the Mac was already patched, patching macOS is generally the appropriate remediation. #### Can I continue using SSH? Yes. SSH is unaffected by CVE-2026-65400 and remains available. #### Can I use Screen Sharing after patching? Yes. We recommend accessing it through a private network, VPN, or SSH tunnel rather than exposing Screen Sharing directly to the Internet. #### What if I am running macOS Ventura or older? Apple has not released a fix for those versions. Contact MacStadium Support for assistance upgrading to a supported macOS version.