VULNpocalypse
MediumVulnerabilityPatch available

Apple iOS 27.2.1 and macOS patches fix iMessage and Bluetooth flaws

Apple fixed iMessage group chat, Bluetooth and AirPlay pairing flaws in 27.2.1 and sibling releases; update your Apple devices.

Published
Updated
Fixed in
iOS and iPadOS 27.2.1, 26.7.3, 18.7.12; macOS Golden Gate 27.2.1, Tahoe 26.7.3, Sequoia 15.8.3; watchOS 27.2.1, 26.6.1; visionOS 27.2.1
Exploitation
No for the Apple-specific flaws, since SecurityWeek reports no Apple advisory mentions exploitation; the bundled Brotli flaw CVE-2026-111497 is in the CISA KEV catalog, with no indication of attacks against Apple products.

Live scores

CVE-2026-113960
EPSS
0.002
low predicted chance of attack
VEDAS
0.047
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-113961
EPSS
0.006
low predicted chance of attack
VEDAS
0.055
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-113963
EPSS
0.001
low predicted chance of attack
VEDAS
0.050
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-113964
EPSS
0.003
low predicted chance of attack
VEDAS
0.055
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-113965
EPSS
0.003
low predicted chance of attack
VEDAS
0.054
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-113968
EPSS
0.003
low predicted chance of attack
VEDAS
0.050
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-113969
EPSS
0.002
low predicted chance of attack
VEDAS
0.048
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-113970
EPSS
0.003
low predicted chance of attack
VEDAS
0.047
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-113971
EPSS
0.002
low predicted chance of attack
VEDAS
0.054
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-111497
EPSS
0.826
very likely to be attacked soon
VEDAS
0.984
strong exploit evidence
On CISA KEV
Yes, since 2026-10-27
Detection rule
No public rule yet
EPSS (chance of attack)
100.1Added to CISA KEV 2026-10-27CVE-2026-111497 EPSS over time2026-102026-11-11
VEDAS (exploit evidence)
100.5Added to CISA KEV 2026-10-27CVE-2026-111497 VEDAS over time2026-102026-11-11

Thin horizontal line: the “likely exploited” threshold (EPSS 0.10, VEDAS 0.5). Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

VEDAS flagged this bug about 3 days before CISA confirmed attacks.

What happened

Apple released security updates on Monday for iOS, iPadOS, macOS, watchOS and visionOS. SANS ISC says the updates fix nine vulnerabilities and lists nine CVEs, none of them the Brotli flaw. SecurityWeek counts 10 vulnerabilities and also covers the Brotli flaw described below. The releases are:

  • iOS and iPadOS 27.2.1, 26.7.3 and 18.7.12
  • macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3
  • watchOS 27.2.1 and 26.6.1
  • visionOS 27.2.1

iMessage. CVE-2026-113961 could let a remote attacker join an iMessage group chat and receive its messages. The Hacker News describes it as an authorization issue fixed through improved validation. CVE-2026-113960 could let a user added to a group access messages sent before they joined. According to The Hacker News, Apple’s notes do not say what an attacker would need, whether group members would see someone who joined this way, or whether every member must update to be protected.

Bluetooth and AirPlay pairing. SecurityWeek says five flaws are fixed in all nine releases:

  • CVE-2026-113964 (CoreUtils): an attacker in Bluetooth range may bypass the rate limit on pairing code attempts and pair with a device without user interaction.
  • CVE-2026-113965 (CoreUtils): a malicious Bluetooth device may establish a pairing without user interaction.
  • CVE-2026-113968 (AirPlay): an attacker in Bluetooth range may bypass the pairing code rate limit.
  • CVE-2026-113969 (rapportd): an attacker on the same network may bypass the rate limit on AirPlay pairing code attempts.
  • CVE-2026-113970 (Bluetooth): described by SecurityWeek as a use-after-free that could let an attacker in Bluetooth range corrupt process memory.

The Hacker News notes that Apple’s notes do not say what a paired device could then do.

Platform-specific flaws.

  • CVE-2026-113963 (App Intents): an app may access sensitive user data. SecurityWeek lists it only for iOS and iPadOS 27.2.1, watchOS 27.2.1 and visionOS 27.2.1.
  • CVE-2026-113971 (MediaRemote): an attacker with physical access may pair a device with an AirPlay receiver from the lock screen. SecurityWeek says it appears only in the iOS and iPadOS 18.7.12 advisory, which covers iPhone XS, XS Max, XR and the seventh-generation iPad. SANS ISC says it applies only to iOS/iPadOS version 26. The sources differ on this point, so the affected version is not confirmed here.

Brotli. The same releases also fix CVE-2026-111497 in Google’s Brotli library. CISA’s KEV catalog lists it as an unchecked return value issue that lets a remote unauthenticated attacker corrupt adjacent decoder state memory using a crafted Brotli-compressed stream. CISA added it on 2026-10-27 with a due date of 2026-11-10, and notes that different products could use the component. SecurityWeek says threat actors have targeted it in the wild, but there is no indication of attacks against Apple products. The Hacker News says Apple’s notes do not mention attacks.

Exploitation of the Apple flaws. SecurityWeek reports that none of the advisories mention exploitation in the wild. It also says Apple credits an anonymous researcher for both Messages bugs and CVE-2026-113964, and László Várady for the App Intents flaw.

Am I affected?

You are in scope if you run Apple devices on any of the operating system versions listed above and have not yet installed the matching update. Coverage is not uniform across the releases.

  • The Hacker News reports that the iOS 18.7.12 and watchOS 26.6.1 notes list other security fixes but not the iMessage or Brotli fixes. Those updates cover devices such as the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple Watch models.
  • Whether devices on those versions are affected by the three flaws is not confirmed, and Apple’s notes offer no workaround.
  • If you maintain software that bundles Google’s Brotli, CISA’s catalog entry names Google Brotli as the affected product. CISA’s notes point to the Brotli v1.2.1 release, but the sources do not confirm which version fixes the flaw.

What to do now

  1. Identify Apple devices in your fleet and their OS versions.
  2. Install the update for each device: iOS/iPadOS 27.2.1, 26.7.3 or 18.7.12; macOS Golden Gate 27.2.1, Tahoe 26.7.3 or Sequoia 15.8.3; watchOS 27.2.1 or 26.6.1; visionOS 27.2.1.
  3. For devices on iOS/iPadOS 18.7.12 or watchOS 26.6.1, read Apple’s per-release notes on its Security Releases page. They may not include the iMessage fixes, so treat their status as not confirmed.
  4. If you ship software that includes Google Brotli, check your version against the upstream release referenced in CISA’s catalog entry.
  5. Note that Apple has not published a workaround for anyone who cannot update right away.

Update, 11 November 2026

  • HKCERT says CVE-2026-111497 (Google Brotli) is being exploited in the wild and rates the Apple bulletin Extremely High Risk. It describes the flaw as allowing a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code. (hkcert.org)
  • HKCERT says the affected versions are all those prior to iOS and iPadOS 27.2.1, 26.7.3 and 18.7.12, macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3, watchOS 27.2.1 and 26.6.1, and visionOS 27.2.1. (hkcert.org)
  • ZDNET says the second Messages bug, in which a user added to a group can read messages sent before they joined, was fixed by removing the code that caused the issue, according to Apple. (zdnet.com)
  • ZDNET says Apple fixed the AirPlay pairing code rate limit bypass with improved state management, and the Bluetooth connection flaw with improved checks. It reports that around half of the flaws were found internally by Apple and the rest were submitted by researchers. (zdnet.com)

Sources