Cyber Threat Brief — August 22 2026
⚠️ This report is AI-generated. Always validate findings.
1. macOS Screen Sharing Pre-Auth RCE Exploited for Cryptojacking — CVE-2026-65400
TL;DR: Pre-auth bypass in macOS Screen Sharing (CVSS 9.8) gives unauthenticated network attackers root RCE on any Mac with Screen Sharing enabled on port 5900. CISA KEV August 18. Microsoft and NCSC-NL confirm active exploitation deploying XMRig miners with SSH persistence.
What’s New:
- CISA rescored from 7.1 to 9.8 and added to KEV August 18; federal deadline September 1
- Microsoft telemetry (August 18): root-level Screen Sharing sign-ins → file transfer → SSH key install → XMRig 6.26.0 deployment as hidden
.config/sysmondbinary - NCSC-NL confirmed exploitation across multiple internet-exposed systems on port 5900
- Public PoC available; Calif researchers weaponized both CVE-2026-65400 and companion CVE-2026-43760 in 4 hours using AI agents
- ~40K internet-exposed Screen Sharing hosts identified, nearly half in U.S. (universities, enterprises, residential)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| TCP/5900 inbound from untrusted IPs | Exploit vector | T1190 | Firewall/flow logs | Block external access to Screen Sharing port |
screensharingd root auth without valid credentials | Pre-auth bypass | T1078 | macOS Unified Log (screensharingd) | Hunt for Screen Sharing auth events with root username |
SSFileCopySender execution | File transfer via Screen Sharing | T1105 | macOS Unified Log, EDR | Alert — indicates attacker file transfer post-exploitation |
.config/sysmond (hidden XMRig binary) | Cryptominer | T1496 | EDR file creation | Hunt for hidden binaries in user .config directories |
com.apple.airportd LaunchDaemon (masqueraded) | Persistence | T1543.004 | macOS LaunchDaemon directory, EDR | Alert — legitimate airportd does not use this plist name pattern for LaunchDaemons |
SSH public key added to authorized_keys | Persistence | T1098.004 | File integrity monitoring | Hunt for unauthorized SSH key additions on macOS hosts |
Packet Filter (pfctl) rule modifications | Defense evasion | T1562.004 | macOS Unified Log | Alert on unexpected PF rule changes |
| XMRig 6.26.0 ad-hoc signed binary | Cryptominer | T1496 | EDR code signing checks | Alert on ad-hoc signed binaries in non-standard paths |
Log/history clearing (rm ~/.bash_history, log erase) | Anti-forensics | T1070.003 | EDR process monitoring | Alert on history/log deletion commands |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | Need: macOS Screen Sharing anomalous root authentication; LaunchDaemon masquerading as Apple service; ad-hoc signed binary execution from hidden paths |
| Elastic | None | Need: macOS unauthorized SSH key deployment; Screen Sharing file transfer to non-standard paths |
| Sigma | None | Need: macOS screensharingd pre-auth root login; PF rule modification by non-admin process; XMRig process indicators on macOS |
Sources: The Hacker News · NCSC-NL Advisory · Microsoft X Post · Calif Blog · CISA KEV · Malwarebytes
2. Microsoft Entra ID Deserialization RCE — CVE-2026-69836
TL;DR: CVSS 10.0 deserialization RCE in Entra ID confirmed exploited August 21. No customer patches needed — Microsoft fixed server-side. Audit Entra sign-in and audit logs for the exposure window; no public IOCs from Microsoft.
What’s New:
- Disclosed August 20, confirmed exploited August 21 — CWE-502 deserialization of untrusted data in Entra ID backend
- Unauthenticated, no user interaction, low complexity — attacker sends crafted serialized objects to vulnerable endpoint
- Microsoft fully mitigated on cloud infrastructure; no customer action required for patching
- Microsoft published NO IOCs, no exploitation timeline, no affected tenant details
- Exploit code not publicly available
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Anomalous Entra ID sign-in events during exposure window | Unauthorized access | T1078.004 | Entra ID Sign-in Logs | Audit for unusual sign-ins (new locations, impossible travel, unfamiliar service principals) |
| New or modified service principals | Persistence | T1098.001 | Entra ID Audit Logs | Review service principal changes created between Aug 1–21 |
| Federation trust configuration changes | Persistence | T1484.002 | Entra ID Audit Logs | Verify no unauthorized federation trusts were added |
| New app registrations with high-privilege API permissions | Privilege escalation | T1098 | Entra ID Audit Logs | Audit app registrations for unexpected Directory.ReadWrite.All or similar |
| Conditional Access policy modifications | Defense evasion | T1562 | Entra ID Audit Logs | Review CA policy changes during exposure window |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Entra ID anomalous sign-in rules (partial) | Need: Entra ID service principal creation anomaly; federation trust modification alert |
| Elastic | None (cloud-specific) | Need: Entra audit log correlation for unauthorized config changes |
| Sigma | None | Need: Entra ID audit log rules for service principal and federation trust anomalies |
Sources: Help Net Security · SecurityWeek · BleepingComputer · The Hacker News · Tenable
Status Updates
- CVE-2026-72529 (TrueConf Server): Federal deadline TOMORROW August 23. Head Mare PhantomCore exploitation ongoing. No new artifacts. Original brief.
- CVE-2026-19490 (Citrix NetScaler): No ITW exploitation confirmed yet. Rapid7 rates exploitation likelihood high. Monitor for PoC release. Original brief.
- CVE-2026-68820 (Windows AFD WinSock): Lazarus FudModule rootkit ongoing. CISA KEV deadline August 25. Original brief.
- CVE-2026-59310 (VMware vCenter): CISA deadline passed August 21. 361 victims, Babuk-derived ESXi ransomware. QUIRSO full report with IOCs expected soon. Original brief.
- CVE-2026-55040 (SharePoint JWT Auth Bypass): Active exploitation ongoing. ~8,500 exposed instances. Original brief.
- Rust arrayref Supply Chain (DPRK): Yanked crates remain in cached builds. Audit
Cargo.lockfor[email protected]. Original brief.