Vulnerability giving attackers full control of Macs is under active exploitation

A critical macOS security flaw tied to the screen-sharing feature is being actively exploited in the wild, allowing remote attackers to gain full system control without needing a password. Apple users are urged to apply patches immediately as real-world attacks are already underway.

A serious vulnerability in macOS is currently being exploited by malicious actors, with the flaw residing in the operating system's screen-sharing functionality. The bug enables remote attackers to authenticate and log into a target Mac without supplying any credentials, effectively granting them unrestricted control over the machine. This type of authentication bypass is considered among the most severe categories of security flaws, since it removes the primary barrier protecting user data and system integrity. Apple has released a fix, and security experts are strongly advising all Mac users to update their systems without delay. The fact that exploitation is already occurring in the wild makes patching especially urgent, as unpatched systems remain exposed to complete remote takeover by anyone aware of the vulnerability.

A high-severity security vulnerability affecting macOS has moved beyond theoretical risk into active real-world exploitation, raising urgent alarms for the tens of millions of people who rely on Apple computers. The flaw is rooted in the screen-sharing feature built into macOS, a tool commonly used for remote desktop access and IT support. Attackers who know how to leverage the bug can connect to a vulnerable Mac remotely and bypass the login process entirely — no username-and-password combination required. Once inside, they have the same level of access as a legitimate user, meaning they can view, copy, delete, or alter any file, install malware, or pivot deeper into a corporate network.

Authentication bypass vulnerabilities are treated as critical precisely because they undermine the most fundamental assumption of computer security: that access requires proof of identity. When that gatekeeper is removed, every other layer of protection — encrypted files, access controls, audit logs — becomes far less meaningful.

Why it matters: This isn't a theoretical research finding sitting in a bug bounty queue — attackers are already using it. That compressed timeline between disclosure and exploitation leaves little room for complacency. For individual users, the risk is unauthorized access to personal data, financial accounts, and private communications. For businesses running Macs, the stakes are higher still: a single compromised endpoint can serve as a launchpad for ransomware deployment or data exfiltration across an entire organization.

Apple has issued a patch addressing the vulnerability, but the window of danger remains open for anyone who has not yet updated. Security professionals recommend immediately applying the latest macOS update, and organizations with managed fleets of Apple hardware should treat this as a priority emergency deployment. In the meantime, users who do not actively need screen-sharing enabled are advised to turn the feature off in system settings as a temporary risk-reduction measure. This incident also serves as a broader reminder that no platform is inherently immune to serious vulnerabilities, and prompt patching remains one of the most effective defenses available.