Our automated tracking framework flagged that CISA added CVE-2026-65400 (Apple macOS) to the Known Exploited Vulnerabilities (KEV) catalog on August 21, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-65400 by August 21, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-65400 |
| Vendor / product | Apple macOS |
| Vulnerability | Apple macOS Improper Authentication Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | August 18, 2026 |
| Days public before listing (NVD → KEV lag) | 12 |
| Federal patch deadline | August 21, 2026 |
| Known ransomware use | No |
How This Compares to Apple’s Track Record
This one was public for just 12 days before CISA confirmed exploitation — faster than Apple’s 56-day median, meaning attackers moved unusually quickly.
| Apple in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 94 |
| Median lag (public → KEV listing) | 56 days |
| 0-day rate (exploited at or before disclosure) | 26% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1673 tracked KEV entries is 266 days — Apple’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Apple KEV Additions
The most recent Apple vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2025-43510 | Multiple Products | March 20, 2026 | 98 | No |
| CVE-2025-31277 | Multiple Products | March 20, 2026 | 233 | No |
| CVE-2025-43520 | Multiple Products | March 20, 2026 | 98 | No |
| CVE-2023-41974 | iOS and iPadOS | March 5, 2026 | 785 | No |
| CVE-2021-30952 | Multiple Products | March 5, 2026 | 1654 | No |
What This Means for Defenders
CISA has added CVE-2026-65400, an Apple macOS vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. With a critical CVSS base score of 9.8, this vulnerability demands immediate attention from all organizations using Apple macOS. The rapid federal patch deadline of August 21, 2026, just three days after its KEV listing on August 18, 2026, highlights the extreme urgency.
This CVE had a mere 12-day lag between its public disclosure and KEV catalog addition. This compressed timeline suggests exploitation was likely detected quickly after the vulnerability became public. Organizations with macOS deployments should patch CVE-2026-65400 before August 21, 2026. If you cannot patch, restrict network access to vulnerable systems and enhance monitoring for unusual activity.
While no known ransomware use has been reported for this CVE, its active exploitation makes rapid mitigation critical. Prompt action can prevent potential compromise.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
