CVE-2026-65400 — Apple macOS Screen Sharing Improper Authentication Exploitation

// Anomalous inbound Screen Sharing / ARD (ports 5900/3283) and screensharingd auth events on macOS
let remoteMgmtPorts = dynamic([5900, 3283]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where DeviceType == "Mac" or InitiatingProcessFileName in~ ("screensharingd", "ARDAgent", "RemoteManagement")
| where ActionType == "InboundConnectionAccepted"
| where LocalPort in (remoteMgmtPorts)
| where not(ipv4_is_private(RemoteIP)) or RemoteIPType == "Public"
| project Timestamp, DeviceName, RemoteIP, RemotePort, LocalPort, InitiatingProcessFileName, InitiatingProcessAccountName
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("screensharingd", "ARDAgent", "sharingd")
    | project DeviceName, AuthProcess=FileName, AuthTime=Timestamp
) on DeviceName
| order by Timestamp desc

index=macos (sourcetype="macos:unifiedlog" OR sourcetype="osquery:results" OR sourcetype="pan:traffic")
| eval dest_port=coalesce(dest_port, LocalPort)
| search (process_name="screensharingd" OR process_name="ARDAgent" OR process="screensharingd" OR dest_port=5900 OR dest_port=3283)
| eval is_public=if(match(src_ip,"^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)")=0,1,0)
| where is_public=1
| stats count min(_time) as firstTime max(_time) as lastTime values(src_ip) as src_ip by host, dest_port, process_name
| where count > 0
| convert ctime(firstTime) ctime(lastTime)
| sort - count

sequence by host.name with maxspan=5m
  [network where destination.port in (5900, 3283) and network.direction == "inbound" and not cidr_match(source.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]
  [process where process.name in ("screensharingd", "ARDAgent", "sharingd") and event.type == "start"]

SELECT sourceip, destinationip, destinationport, "Process Name" AS process, QIDNAME(qid) AS event_name, COUNT(*) AS cnt
FROM events
WHERE destinationport IN (5900, 3283)
  AND INCIDR('10.0.0.0/8', sourceip) = FALSE
  AND INCIDR('172.16.0.0/12', sourceip) = FALSE
  AND INCIDR('192.168.0.0/16', sourceip) = FALSE
  AND (LOGSOURCETYPENAME(logsourceid) ILIKE '%mac%' OR "Process Name" ILIKE '%screensharingd%' OR "Process Name" ILIKE '%ARDAgent%')
GROUP BY sourceip, destinationip, destinationport, process
LAST 24 HOURS

_sourceCategory=macos/* OR _sourceCategory=network/firewall
| where (dest_port = 5900 or dest_port = 3283) or process_name in ("screensharingd", "ARDAgent", "sharingd")
| where !(src_ip matches "10.*" or src_ip matches "192.168.*" or src_ip matches "172.1[6-9].*" or src_ip matches "172.2*" or src_ip matches "172.3[01].*")
| count as cnt by host, src_ip, dest_port, process_name
| where cnt > 0
| sort by cnt desc

rule cve_2026_65400_macos_screensharing_auth_bypass {
  meta:
    author = "Argus"
    description = "Inbound Screen Sharing/ARD from public IP to macOS host (CVE-2026-65400)"
    severity = "HIGH"
  events:
    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.target.port in %remote_mgmt_ports
    $net.network.direction = "INBOUND"
    net.principal.ip."is_private" = false
    $net.target.hostname = $host
  match:
    $host over 5m
  condition:
    $net
}

#event_simpleName=/NetworkConnectIP4|NetworkListenIP4/
| RemotePort=5900 OR RemotePort=3283 OR LocalPort=5900 OR LocalPort=3283
| ConnectionDirection=1
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"])
| join({#event_simpleName=ProcessRollup2 FileName=/screensharingd|ARDAgent|sharingd/}, field=aid, include=[FileName])
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort], function=count())
| sort(_count, order=desc)