Microsoft Patches Dozen-Plus Flaws, Apple Fixes Screen Sharing Bug CVE-2026-65400

Microsoft and Apple both shipped security updates on Thursday, August 6, 2026. Microsoft led with fixes for more than a dozen vulnerabilities across Active Directory, Azure, Entra, SharePoint, Teams and other products. Several are critical-severity remote code execution issues.

Apple's release was smaller, covering a single defect. The company said the flaw could let an attacker on the network authenticate to Screen Sharing without valid credentials.

Three Microsoft issues carry a maximum CVSS severity of 10/10, and all three are exploitable over the network. Each can lead to elevation of privilege.

• CVE-2026-63508: missing authentication in Planetary Computer Pro
• CVE-2026-56162: improper authentication in Azure SQL Database
• CVE-2026-65667: missing authorization in Teams

Four more flaws score 9.9/10 and are also remotely exploitable: CVE-2026-50515 (RCE in Azure Service Bus), CVE-2026-62830 (EoP in Azure SRE Agent), CVE-2026-59115 (EoP in Entra Provisioning Service) and CVE-2026-50481 (EoP in Active Directory). These touch identity and messaging infrastructure, so a successful attack could spread across a tenant.

CVE-2026-65400 (CVSS 7.5) is a Screen Sharing authentication bypass in macOS. Apple says an attacker on the same network could authenticate to Screen Sharing without valid credentials, which could give them remote access to a Mac's desktop session.

Apple shipped the patch in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. The update arrived about a week after Apple fixed dozens of defects with iOS 26.6 and macOS Tahoe 26.6.

The Microsoft flaws hit organizations running the affected cloud and identity services. If you use Entra for provisioning or Active Directory for on-premises identity, treat the 9.9-rated EoP issues as high priority. Privilege escalation in those layers can break wider access controls.

On the Apple side, any Mac on an affected macOS version with Screen Sharing reachable over the network is exposed until you update it. Shops that enable remote screen sharing for support desks are the most likely to have this surface open.

Microsoft's August 6 updates followed one week after the company shipped over two dozen fixes for Office, 365 Apps for Enterprise, Edge and Azure Cosmos DB. The back-to-back releases point to a steady stream of cloud- and identity-focused patches, not a single monthly bundle.

Apple kept a similar rhythm. The single Screen Sharing fix arrived about a week after a larger set of defects went out with iOS 26.6 and macOS Tahoe 26.6.

Start with the remotely exploitable Microsoft flaws rated 9.9 and above. Microsoft applies most cloud-service fixes on its side, but confirm affected components are current and check access logs for the identity services involved.

1. Apply the three 10/10 fixes for Planetary Computer Pro, Azure SQL Database and Teams.
2. Address the four 9.9 flaws in Azure Service Bus, Azure SRE Agent, Entra Provisioning Service and Active Directory.
3. Update macOS endpoints to Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9 to close CVE-2026-65400.
4. Restrict Screen Sharing network exposure where remote access isn't required.

Multiple remotely exploitable Microsoft flaws could enable elevation of privilege or remote code execution across cloud and identity services. Apple's fix removes a network-based Screen Sharing bypass on macOS.

Security: Successful exploitation of the Microsoft flaws could lead to elevation of privilege, remote code execution, information disclosure and spoofing.

Privacy: The Screen Sharing bypass could expose a Mac desktop session to unauthorized network attackers.

On August 6, 2026, Microsoft patched more than a dozen vulnerabilities, including three rated 10/10 and four rated 9.9. Apple fixed a single Screen Sharing bypass, CVE-2026-65400, in three macOS versions.