CVE-2026-43665 Overview
CVE-2026-43665 is an information disclosure vulnerability in Apple macOS that allows a local attacker to determine the legacy Virtual Network Computing (VNC) password configured for Screen Sharing. The flaw stems from missing entitlement checks around access to Screen Sharing configuration data. Apple resolved the issue by adding additional entitlement enforcement in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. The weakness is classified as [CWE-862] Missing Authorization.
Critical Impact
A local attacker with low-privilege access to a macOS host can recover the legacy VNC password used by Screen Sharing, enabling subsequent remote access to the system.
Affected Products
- Apple macOS Sequoia versions prior to 15.7.8
- Apple macOS Sonoma versions prior to 14.8.8
- Apple Screen Sharing legacy VNC configuration component
Discovery Timeline
- 2026-07-27 - CVE-2026-43665 published to the National Vulnerability Database (NVD)
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-43665
Vulnerability Analysis
The vulnerability resides in the macOS Screen Sharing subsystem, which historically supports a legacy VNC protocol authenticated with a stored password. Apple's advisory states the issue was addressed with additional entitlement checks, indicating that the protected resource holding the legacy VNC password was accessible without adequate authorization gating.
A local attacker executing code under a standard user context can query the affected interface and retrieve the plaintext or reversibly stored VNC password. Because Screen Sharing typically listens for remote connections, recovering this credential can pivot local access into remote graphical control of the host.
The CWE classification of Missing Authorization ([CWE-862]) aligns with Apple's remediation language. The fix does not alter how the password is stored; it restricts which callers may read it by requiring an entitlement the attacker cannot obtain.
Root Cause
The affected macOS component exposed the legacy VNC password to callers without verifying that the requesting process held the entitlement required to access Screen Sharing secrets. Any local process running under an interactive user session could read the value.
Attack Vector
Exploitation requires local access to the target macOS system with valid, low-privilege user credentials. No user interaction is needed. The attacker invokes the affected interface, retrieves the legacy VNC password, and can then authenticate to the Screen Sharing service either locally or across the network if Screen Sharing is exposed.
No public proof-of-concept exploit code, ExploitDB entry, or CISA Known Exploited Vulnerabilities listing exists for CVE-2026-43665 at the time of publication.
Detection Methods for CVE-2026-43665
Indicators of Compromise
- Unexpected screensharingd connections originating from internal hosts or new external IP addresses following local user activity.
- Non-administrative processes reading Screen Sharing preference files or querying Screen Sharing configuration APIs.
- New or modified entries in com.apple.screensharing preference domains on unpatched macOS Sequoia 14.x or Sonoma 15.x systems.
Detection Strategies
- Monitor for local processes accessing Screen Sharing configuration data outside of expected system daemons and administrative tooling.
- Correlate local user process activity with subsequent successful VNC or Screen Sharing authentications on the same host.
- Alert on enabling of legacy VNC password authentication for Screen Sharing, which is discouraged on modern macOS deployments.
Monitoring Recommendations
- Ingest Unified Log events for com.apple.screensharing and screensharingd into a centralized logging platform for retention and analysis.
- Track macOS version inventory to identify hosts still running builds earlier than 15.7.8 or 14.8.8.
- Baseline authorized administrators of Screen Sharing and alert on configuration changes made by other accounts.
How to Mitigate CVE-2026-43665
Immediate Actions Required
- Update affected macOS endpoints to macOS Sequoia 15.7.8 or macOS Sonoma 14.8.8 through Software Update or managed device management (MDM) workflows.
- Rotate any legacy VNC passwords configured for Screen Sharing after patching, since exposed credentials remain valid until changed.
- Disable Screen Sharing on hosts that do not require it, and restrict inbound access to management networks where it is required.
Patch Information
Apple has released fixes in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8 that add the required entitlement checks. Refer to the Apple Security Update for macOS Sonoma 14.8.8 and the Apple Security Advisory for macOS Sequoia 15.7.8 for full release details and build numbers.
Workarounds
- Disable the legacy VNC password option in Screen Sharing preferences and require authenticated Apple ID or directory user sessions instead.
- Turn off Screen Sharing entirely on systems that cannot be patched immediately.
- Restrict local logon rights on affected hosts to trusted administrative users to reduce the population of accounts that can trigger the flaw.
# Disable Screen Sharing on macOS until patches can be deployed
sudo launchctl disable system/com.apple.screensharing
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist
# Verify installed macOS build meets the patched version
sw_vers -productVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
