Vulnerability giving attackers full control of Macs is under active exploitation
Vulnerability giving attackers full control of Macs is under active exploitation
导致 Mac 被完全控制的漏洞正遭到积极利用
Dutch officials have warned that a high-severity macOS vulnerability that allows attackers to execute malicious code is under active exploitation. 荷兰官员警告称，一个允许攻击者执行恶意代码的高危 macOS 漏洞正遭到积极利用。
“The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” the Netherlands National Cyber Security Centrum warned earlier this week. “In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed.” 荷兰国家网络安全中心（NCSC）本周早些时候警告称：“NCSC 已收到通知，显示在多个可通过互联网访问 5900 端口的系统上，观察到了对该漏洞的积极滥用。在所有这些案例中，受影响系统的 root 权限均已被获取，并被植入了门罗币（Monero）挖矿程序。”
The vulnerability, tracked as CVE-2026-65400, received a patch from Apple last week for macOS Tahoe, Sequoia, and Sonoma. The vulnerability, with a severity rating of 7.1 out of 10, stems from a bug in the macOS screen sharing capability, which allows a remote party to view the screen and control the keyboard and mouse while a machine is turned on. 该漏洞被追踪为 CVE-2026-65400，苹果公司已于上周为 macOS Tahoe、Sequoia 和 Sonoma 发布了补丁。该漏洞的严重性评分为 7.1 分（满分 10 分），源于 macOS 屏幕共享功能中的一个错误，该错误允许远程方在机器开启时查看屏幕并控制键盘和鼠标。
A flaw in the “state management,” which keeps track of preceding events, user interactions, variables, and other system states, is the underlying cause. A video of the exploit in action can be found here. Details of CVE-2026-65400 became public at last week’s Black Hat security conference. 其根本原因是“状态管理”中的缺陷，该机制负责跟踪先前的事件、用户交互、变量和其他系统状态。此处可以找到该漏洞利用过程的视频。CVE-2026-65400 的详细信息已在上周的 Black Hat 安全会议上公开。
Apple said last week that CVE-2026-65400 “may” allow an attacker without credentials to gain access to a Mac. It’s unclear why Apple hedged, but softening language is common among most tech developers when disclosing vulnerabilities. 苹果上周表示，CVE-2026-65400 “可能”允许未经授权的攻击者访问 Mac。目前尚不清楚苹果为何措辞谨慎，但在披露漏洞时，大多数科技开发商使用缓和的语言是常见的做法。
As noted by the NCSC, the vulnerability is being exploited when port 5900 is exposed to the Internet. When screen sharing is turned on, the macOS firewall opens the port. Routers and dedicated firewalls generally block the port unless configured to override that setting. 正如 NCSC 所指出的，当 5900 端口暴露在互联网上时，该漏洞就会被利用。当开启屏幕共享时，macOS 防火墙会打开该端口。除非配置了覆盖该设置，否则路由器和专用防火墙通常会阻止此端口。
Security practitioners generally advise Mac users to keep the port closed even when using screen sharing and to instead connect over a VPN or through SSH tunneling. The alternatives require actions that aren’t within the capabilities of most users. The safest practice is to block screen sharing, enable it only when screen sharing is needed, and to turn the feature off once a session has ended. 安全从业者通常建议 Mac 用户即使在使用屏幕共享时也应保持该端口关闭，转而通过 VPN 或 SSH 隧道进行连接。这些替代方案需要大多数用户无法掌握的操作技能。最安全的做法是阻止屏幕共享，仅在需要时开启，并在会话结束后关闭该功能。
Screen sharing can be turned on or off by accessing System Settings > General > Sharing and toggling the switch for Screen Sharing. Of course, installing last week’s security update is also a must. 用户可以通过访问“系统设置” > “通用” > “共享”，并切换“屏幕共享”开关来开启或关闭该功能。当然，安装上周的安全更新也是必须的。
Right now, there are no indications exploits are being used to install anything other than Monero miners, which surreptitiously harness a Mac’s resources to perform mathematical operations that generate the cryptocurrency for the attacker. A bigger risk is that attackers might exploit the vulnerability to install malware that steals credentials or performs other more nefarious activities. 目前，没有迹象表明这些漏洞被用于安装门罗币挖矿程序以外的其他软件。这些挖矿程序会秘密利用 Mac 的资源进行数学运算，从而为攻击者生成加密货币。更大的风险在于，攻击者可能会利用该漏洞安装恶意软件，以窃取凭据或执行其他更恶劣的活动。