Apple Patches CVE-2026-43760 Screen Sharing Flaw Granting Root Access on macOS
A vulnerability in the Screen Sharing feature of macOS allows remote attackers to execute commands with root privileges on affected systems. The flaw, tracked as CVE-2026-43760, resides in the screensharingd service and impacts configurations where Screen Sharing or Remote Management is enabled together with the legacy option permitting VNC viewers to connect using a password.
Exploitation requires the attacker to know the configured VNC password. Because connections authenticated via the VNC mechanism are not bound to a specific macOS user account, file-transfer components continue to run with root privileges. Researchers demonstrated that an attacker could request protected system files such as /etc/sudoers or create new files inside normally restricted directories.
The ability to write files significantly increased the impact. An attacker could insert a policy file into /private/etc/sudoers.d and grant a non-administrative account the right to execute commands via sudo without providing a password.
The Apple security bulletin describes the impact as possible access to sensitive user data. The company released fixes for CVE-2026-43760 in macOS Tahoe 26.6 and macOS Sonoma 14.8.8 on July 27, 2026.
Related articles
SCCM Misconfigurations Expose Organizations to Full Infrastructure Takeover
BI.ZONE expert Alexander Kuznetsov details how Microsoft Configuration Manager (SCCM) deployments in 25% of Russian organizations can grant attackers complete control over corporate infrastructure when misconfigured. The article outlines critical risks including administrative privilege escalation, lateral movement, data collection, persistence, and policy manipulation that allow attackers to blend with legitimate maintenance operations. Key recommendations focus on infrastructure isolation, placing Site Server, SMS Provider, and Site Database Server roles in Tier 0 segments, and avoiding single SCCM hierarchies across multiple Active Directory forests or security tiers. The report emphasizes eliminating Network Access Account (NAA) usage in favor of HTTPS or Enhanced HTTP, strictly limiting Client Push Account and domain join account privileges, and auditing computer accounts for site servers. Additional guidance covers PXE deployment risks, database access restrictions, and role-based administrative controls to prevent credential extraction via tools such as SharpSCCM and mimikatz. Overall, the publication provides actionable hardening steps aligned with the principle of least privilege to reduce the attack surface of widely deployed SCCM environments.
Critical Vulnerability in ASUS Control Center Enterprise Allows Remote Root Access Without Authentication
ASUS has disclosed a severe vulnerability in its terminal management software ASUS Control Center Enterprise (ACC) that could allow unauthenticated remote attackers to obtain root privileges. The issue, tracked as CVE-2026-75754, stems from a combination of hardcoded credentials, missing authentication on critical functions, and server-side request forgery flaws. Attackers can retrieve encryption keys via unauthenticated HTTP requests and then enable SSH on TCP port 2222 using the hardcoded credentials to log in as root. The flaw affects managed devices across an organization, potentially leading to data leakage, tampering, deletion, and full remote control. ASUS released a security advisory on September 4, 2026, and strongly recommends immediate updates. The vulnerability was reported by Security NEXT on September 7, 2026.
Top 10 Security Stories: Critical Flaws in PaperCut NG/MF, Chrome, WatchGuard and Others Dominate Week
Security NEXT has published its weekly ranking of the ten most-read articles between August 30 and September 5 2026. The list is led by a critical vulnerability in PaperCut NG/MF that is already being exploited in the wild. Google Chrome received two separate updates addressing 38 vulnerabilities, including two rated Critical and one zero-day. WatchGuard Fireware OS, SonicWall SMA 1000, Cisco IOS XR and Apache Tomcat also received urgent patches for severe flaws. Three real-world incidents made the top ten: a customer-data breach at 01 Bank, a ransomware infection at Hands HD and a suspected cloud leak at Corona. The ranking reflects strong reader interest in both newly disclosed vulnerabilities and confirmed exploitation cases.
CVE-2026-85046 Exploited in Chromium V8 Engine, Affecting Chrome, Edge and Other Browsers
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaw resides in the V8 JavaScript engine of Chromium and stems from a type confusion issue that can allow arbitrary code execution inside the sandbox when a crafted HTML page is processed. Google released a patch for Chrome on September 3, 2026, while the vulnerability carries a CVSS v3.1 base score of 8.8 and is rated High severity. Because numerous browsers including Microsoft Edge, Opera, and Vivaldi are built on Chromium, they are potentially exposed until their respective vendors issue updates. Security teams are advised to verify that all Chromium-based browsers in their environments have been updated to the latest versions containing the fix.