Apple Patches CVE-2026-43760 Screen Sharing Flaw Granting Root Access on macOS
A vulnerability in the macOS Screen Sharing feature allows remote attackers to execute commands with root privileges under specific configurations. Identified as CVE-2026-43760 and tied to the screensharingd service, the flaw affects systems with Screen Sharing or Remote Management enabled alongside the legacy VNC password option. Attackers who know the VNC password can exploit unauthenticated account binding to retrieve protected files such as /etc/sudoers or write policies into /private/etc/sudoers.d. This grants non-privileged accounts passwordless sudo rights. The issue stems from VNC-authenticated connections not being mapped to specific macOS accounts while file-transfer components retain root privileges. Apple addressed the vulnerability in macOS Tahoe 26.6 and macOS Sonoma 14.8.8, both released on July 27, 2026.
BoletimSecAug 18, 2026Translated from Portuguese