A critical vulnerability has been identified in macOS Screen Sharing, posing a significant security risk by allowing unauthorized users to execute root commands. Tracked as CVE-2026-43760, this flaw affects the screensharingd service and its associated file-copy helpers, SSFileCopySender and SSFileCopyReceiver, specifically on macOS systems where Screen Sharing or Remote Management is enabled with the legacy VNC password option. The vulnerability stems from a logic flaw in how Apple’s Screen Sharing service manages authentication. When users connect through native Apple authentication, file operations are executed under the user's permissions. However, when connecting via the older VNC authentication method, the service does not correctly identify the user identity, inadvertently granting root-level permissions. This discrepancy in authentication creates two vulnerabilities. Remote viewers could exploit SSFileCopySender to access protected files like /etc/sudoers, while SSFileCopyReceiver allows writing files with root authority. Security researchers demonstrated how this could be used to insert a malicious sudoers policy, granting passwordless sudo access to non-admin accounts and enabling remote root shell access. Apple has addressed this flaw in macOS Tahoe 26.6 and macOS Sonoma 14.8.8, released on July 27, 2026. Users unable to update immediately are advised to disable the VNC option or turn off Screen Sharing and Remote Management if remote access is not essential. Changing the VNC password alone does not resolve the vulnerability. This case highlights a shift in security research focus toward logic and authorization vulnerabilities as traditional memory exploitation becomes more challenging.