CISA-ADP score and press coverage disagree on severity for the exploited macOS Screen Sharing bypass

Sources: NVD, Ars Technica, Apple advisory 148170, Apple advisory 148171, Apple advisory 148172
Summary: The 2026-08-15 digest led with NCSC-NL's report of active exploitation of CVE-2026-65400, the macOS Screen Sharing authentication bypass, and this entry carries only what is new against it. The CISA-ADP entry in NVD scores the flaw 9.8 critical with a fully remote no-interaction vector, the Ars Technica report of 2026-08-14 gives 7.1, and NVD has published no base score of its own. CISA-ADP replaced its own vector on 2026-08-14, removing a vector that required local privileges and scored partial integrity impact and no availability impact, and adding the fully remote 9.8 vector, so the scorer revised itself upward on the same date the press figure was published. The NVD record was modified 2026-08-17, and its SSVC entry still reads exploitation none as of that date. NVD lists affected macOS 14.0 up to 14.8.9, 15.0 up to 15.7.9, and 26.0 up to 26.6.1, fixed in Sonoma 14.8.9, Sequoia 15.7.9, and Tahoe 26.6.1.
Why it matters: The same patched and actively exploited remote bypass reads as high or as critical depending on whether a triage process takes the CISA-ADP score or the severity given in press coverage.
Follow-up: Track whether NVD publishes its own base score and corrects the exploitation status.