CVE-2026-43665

Analyzed Analyzed - Analysis Complete

Legacy VNC Password Disclosure in macOS Screen Sharing

Publication date: 2026-07-27

Last updated on: 2026-10-24

Assigner: Apple Inc.

Description

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker may be able to determine the legacy VNC password configured for Screen Sharing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-10-24

Generated

2026-11-08

AI Q&A

2026-07-28

EPSS Evaluated

2026-11-07

NVD

CVE-2026-43665

EUVD

EUVD-2026-49449

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	From 14.0 (inc) to 14.8.8 (exc)
apple	macos	From 15.0 (inc) to 15.7.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves a local attacker being able to determine the legacy VNC password used for Screen Sharing on macOS systems. It was addressed by adding additional entitlement checks in updated versions of macOS Sequoia and Sonoma.

Detection Guidance

This vulnerability involves a local attacker potentially accessing the legacy VNC password for Screen Sharing on macOS. Detection requires checking Screen Sharing settings and VNC password configuration on affected macOS versions before 15.7.8 or 14.8.8. Verify if Screen Sharing is enabled and if a legacy VNC password is set. No specific commands are provided in the context to detect this issue.

Impact Analysis

An attacker could exploit this to gain unauthorized access to your Screen Sharing service, potentially allowing them to view or control your system remotely if the legacy VNC password is weak or reused.

Compliance Impact

The vulnerability allows a local attacker to determine the legacy VNC password configured for Screen Sharing. This could lead to unauthorized access to sensitive data, potentially violating confidentiality requirements under GDPR and HIPAA.

Mitigation Strategies

Update to the latest version of macOS Sequoia 15.7.8 or macOS Sonoma 14.8.8 to address the issue. Disable Screen Sharing if not needed or ensure the legacy VNC password is not used.

Hi! I’m here to help you understand CVE-2026-43665. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...