Apple’s latest macOS updates address a serious Screen Sharing vulnerability

Apple has published the security details for today’s macOS Tahoe, Sequoia, and Sonoma updates, and those notes make clear that all three releases fix a serious Screen Sharing vulnerability. The disclosure covers the full current macOS lineup rather than a single branch, so anyone still on Sonoma or Sequoia, not only users who have moved to Tahoe, is in scope for the same class of fix.

Screen Sharing is the built-in remote-display and remote-control path many Macs use for support, lab access, and multi-machine workflows. A serious flaw in that path sits on a trust boundary: the service is meant to show or control a desktop only for authorized sessions. When Apple ships the same Screen Sharing fix across Tahoe, Sequoia, and Sonoma, it signals that the bug lived in shared remote-session code rather than in a one-off release quirk.

For engineers and builders, that matters because Screen Sharing often sits next to admin accounts, jump hosts, CI machines, and personal workstations that hold source and credentials. Remote desktop surfaces are high-value if session handling or access checks fail. Applying today’s Tahoe, Sequoia, and Sonoma updates is the direct way to close the hole Apple has now documented.

Competitively, Apple is following the usual coordinated model: ship the patches first, then publish the security detail so admins can map risk without a long dark period after the binary is out. Covering three macOS generations at once reduces the “still on the previous OS” gap that remote-access bugs often exploit. Rival desktop platforms face the same pressure whenever remote-view or remote-control code is shared across supported releases.

Practical takeaway: install today’s macOS Tahoe, Sequoia, or Sonoma update on any Mac that has Screen Sharing enabled or that might have had it enabled historically, then confirm Screen Sharing settings still match policy. Watch Apple’s security notes and 9to5Mac’s write-up for any follow-on detail on how the vulnerability was triggered and whether related remote-access components get further patches in the next point releases.