Vulnerability giving attackers full control of Macs is under active exploitation

A critical zero-day vulnerability in macOS allows remote attackers to gain full control of Mac computers without requiring a password. The flaw exists in the screen-sharing functionality built into Apple's operating system, enabling threat actors to bypass authentication entirely and access compromised machines.

Security researchers have confirmed active exploitation of this vulnerability in the wild. Attackers leverage the screen-sharing feature to establish remote connections and execute commands with unrestricted privileges. The bug affects multiple macOS versions, though Apple has not yet released a comprehensive patch addressing the root cause.

The vulnerability stems from improper validation in how macOS handles screen-sharing requests. An attacker on the same network or with access to a Mac's IP address can trigger the flaw without user interaction or consent. Once exploited, the attacker gains the same access level as the legitimate user, allowing theft of sensitive data, installation of malware, or complete system compromise.

This discovery underscores a persistent challenge in macOS security. While Apple markets its operating system as inherently secure, these incidents reveal that critical flaws can slip through the development process undetected. The active exploitation suggests attackers have already weaponized this bug, putting Mac users at immediate risk.

Apple users should immediately disable screen sharing if not actively needed. The company typically recommends this workaround for zero-day vulnerabilities until patches become available. Users relying on remote access functionality should implement network-level protections, such as VPNs or firewalls, to restrict screen-sharing traffic to trusted sources only.

Researchers continue investigating the scope of exploitation and whether additional undiscovered variants of this vulnerability exist. This incident reinforces the importance of applying security updates promptly once patches become available and maintaining defensive postures beyond relying solely on built-in OS protections.