Is CVE-2026-65400 being actively exploited?

Yes. CVE-2026-65400 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on August 18, 2026.

What is the CVSS score for CVE-2026-65400?

CVE-2026-65400 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2026-65400

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 1.7%EU EUVD: exploited

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-287
EPSS score: 1.7% (77th percentile)
In CISA KEV: Yes, added August 18, 2026
In EU EUVD: Yes (EUVD-2026-54216)
Published: August 6, 2026
NVD last modified: September 15, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Apple macOS Improper Authentication Vulnerability

Added to the KEV catalog on August 18, 2026; federal remediation due August 21, 2026.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2026-54216 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on September 14, 2026.

View on the EU Vulnerability Database

Affected products

apple / macos

Certified products that may be affected

10 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Apple macOS 26 Tahoe: FileVault - Apple Inc. - Common Criteria CCEVS-VR-VID-11696-2026 - active
Apple macOS 26 Tahoe - Apple Inc. - Common Criteria CCEVS-VR-VID-11695-2026 - active
Apple macOS 15 Sequoia - Apple Inc. - Common Criteria CCEVS-VR-VID-11648-2026 - active
Strong Customer Authentication for Apple Pay on MacBook Air 2024 with M3running macOS Sequoia 15.4 - Apple Inc. - Common Criteria 2025-11-INF-4674 - active
Apple macOS 14 Sonoma - Apple Inc. - Common Criteria CCEVS-VR-VID-11584-2025 - active

See all 10 in the Security Certifications Explorer.

References

http://seclists.org/fulldisclosure/2026/Aug/36(Mailing List)
http://seclists.org/fulldisclosure/2026/Aug/37(Broken Link)
https://advisories.ncsc.nl/2026/ncsc-2026-0280.html(Third Party Advisory)
https://support.apple.com/en-us/148170(Release Notes, Vendor Advisory)
https://support.apple.com/en-us/148171(Release Notes, Vendor Advisory)
https://support.apple.com/en-us/148172(Release Notes, Vendor Advisory)
https://support.apple.com/en-us/149035(Release Notes, Vendor Advisory)
https://support.apple.com/en-us/149042(Release Notes, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain