Apple Patches CVE-2026-43760 RCE on macOS, as AI Bug Flood Delayed 8.6-Severity Report
Updated
Updated · TechRadar · Aug 4
Apple Patches CVE-2026-43760 RCE on macOS, as AI Bug Flood Delayed 8.6-Severity Report
3 articles · Updated · TechRadar · Aug 4
Summary
July 27 updates for macOS Tahoe 26.6 and Sonoma 14.8.8 closed CVE-2026-43760, a high-severity flaw that let attackers execute code as root on vulnerable Macs.
Bynario said the bug affected devices with Screen Sharing or Remote Management enabled and the legacy VNC password option turned on; with only that VNC password, an attacker could create root-owned files and gain passwordless sudo.
More than 50 open submissions in three weeks left the researchers unable to file the issue sooner after Apple capped active reports amid a flood of AI-generated bug reports, though Apple later contacted Bynario directly and patched it.
Unpatched users should disable the legacy "VNC viewers may control screen with password" setting or turn off Screen Sharing and Remote Management entirely.
The disclosure follows another macOS Screen Sharing root-access fix reported a day earlier, underscoring recurring risk around Apple’s remote access features.