Vulnerabilities
Apple fixes iMessage group snooping and silent pairing
iOS 27.2.1 and eight sibling updates fix a remote iMessage group chat flaw and Bluetooth pairing that needs no tap. Target builds, workarounds and checks.
On November 9, Apple shipped nine security updates in one batch: iOS and iPadOS 27.2.1, 26.7.3 and 18.7.12, macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3, watchOS 27.2.1 and 26.6.1, and visionOS 27.2.1. Together they fix ten vulnerabilities. Two stand out for any organization that runs work conversations on iPhones and Macs: CVE-2026-113961 lets "a remote attacker" join an iMessage group chat and receive its messages, and CVE-2026-113965 lets a malicious Bluetooth device pair with an iPhone, Mac or Apple Watch "without user interaction".
Apple does not mark any of the ten as exploited on its own platforms. One of them, though, is the Brotli decoder flaw CVE-2026-111497, which CISA added to its Known Exploited Vulnerabilities (KEV) catalog on October 27; Apple is only now shipping the fixed library. The pairing flaws reach back to the iPhone XS and XR, and the iMessage flaws affect every supported Mac release. If staff use group iMessage for anything sensitive, or carry phones with Bluetooth on through airports and conferences, push this batch this week.
How the iMessage flaws work
An iMessage group is a list of participants that every member's device trusts. When someone sends a message, their device encrypts a copy for each member on that list, so whoever controls the list controls who can read.
CVE-2026-113961 is described as "an authorization issue" fixed "with improved validation". CISA's score for it in the National Vulnerability Database (NVD) is 7.5, network reachable with no privileges and no user interaction. Our reading of that wording: some step that adds a participant to a group did not check that the request came from someone allowed to make it, so an outsider could get onto the list and start receiving every new message. Apple has not said whether the intruder shows up in the member list or what the attacker must know about the group first.
CVE-2026-113960 is the companion bug: a person legitimately added to a group could read messages sent before they joined. Apple fixed it "by removing the vulnerable code". Chained with the first flaw, an attacker who forced their way into a group could have read its backlog as well as new traffic. That chain is our reading; Apple has not described the two together. Neither Messages fix appears in iOS 18.7.12 or watchOS 26.6.1, and Apple does not say whether those versions are affected.
How the pairing flaws work
Bluetooth and AirPlay pairing rely on a short code that the user reads off one screen and types or confirms on the other. A code of a few digits is only safe because the receiving device limits wrong guesses; without that limit, a script can try every code in minutes. CVE-2026-113968 (AirPlay) and CVE-2026-113964 (CoreUtils), both scored 5.4 by CISA, let an attacker in Bluetooth range get around the cap on pairing code attempts, and Apple says the CoreUtils one ends with a completed pairing "without user interaction". CVE-2026-113969 is the same class of bug in rapportd, the service behind device-to-device features such as Continuity, and needs only the same network.
CVE-2026-113965, also in CoreUtils, skips the guessing entirely: a malicious Bluetooth device "may be able to establish a pairing without user interaction" because a check was missing. CVE-2026-113970 is a use-after-free in the Bluetooth stack, where code keeps using memory after it has been freed, which an attacker in range could use to corrupt a process's memory. CISA scores it 8.8, the highest of the Apple-specific bugs; Apple itself claims nothing beyond memory corruption.
A pairing the owner never saw lasts until someone removes it, and depending on the device type it can exchange data or act as an audio or input device.
CVE-2026-111497 is the one with a history. It is an out-of-bounds write in Google's Brotli decoder, versions 1.0.3 through 1.2.0, triggered by a crafted compressed stream; NVD scores it 9.8, CISA's federal deadline is November 10, and our Brotli post covers how it reaches code execution in Node.js. Apple does not say which of its components decode Brotli data or how attacker input would reach them, and the fix is absent from iOS 18.7.12 and watchOS 26.6.1.
The remaining fixes are narrower. CVE-2026-113963 in App Intents lets an installed app read sensitive user data and is fixed only in iOS, watchOS and visionOS 27.2.1. CVE-2026-113971, fixed only in iOS 18.7.12, lets someone holding a locked iPhone XS or XR pair it with an AirPlay receiver from the lock screen.
What attackers are doing
Nothing public. Apple credits the two Messages bugs and one CoreUtils bug to anonymous researchers, the App Intents bug to László Várady, and the rest, apart from the Brotli bug, to its own staff. For the nine Apple-specific bugs there are no indicators of compromise and no reports of use in the wild. By November 10, CISA had scored most of them in NVD; CVE-2026-113960 and CVE-2026-113969 were still unscored. Expect researchers to diff patched and unpatched builds in the coming weeks, which usually makes terse fixes easier to exploit.
What to do
- Set the target builds in your device management. iPhone 11 and later go to iOS 27.2.1, or 26.7.3 if you hold devices on iOS 26. iPhone XS, XS Max, XR and iPad 7th generation go to 18.7.12, the last update they get. Macs go to Golden Gate 27.2.1, Tahoe 26.7.3 or Sequoia 15.8.3. Watches and Vision Pro follow the graphic above. In Jamf, Intune or another mobile device management (MDM) tool, use a declarative software update enforcement with a deadline, so devices install even if users keep tapping "Later".
- Plan for the iOS 18 gap. iOS 18.7.12 does not list the iMessage fixes. Apple does not say whether iOS 18 is affected, so move any phone that can run a newer line. For iPhone XS and XR, which cannot go further, keep sensitive group conversations off iMessage and plan their replacement.
- If you cannot update today. On phones that travel, turn Bluetooth off in Settings; the Control Center toggle only disconnects accessories and leaves Bluetooth running. On Macs, switch off AirPlay Receiver (System Settings, General, AirDrop & Handoff on recent macOS versions). There is no setting that closes the iMessage flaws, so for groups that discuss incidents, deals or credentials, move the conversation to a channel your organization controls until devices are patched.
- Look for traces. After updating, open the details of each work group chat and confirm every participant is someone a member added. On iPhone, check Settings, Bluetooth, My Devices, and on Mac, System Settings, Bluetooth, and remove any device nobody recognises. On Macs,
system_profiler SPBluetoothDataTypelists paired devices with their addresses, which you can collect across the fleet with your MDM's script runner. - Clean up. If you find an unknown group member, remove them, start a fresh group on patched devices, and treat anything shared in the old group, especially passwords or one-time codes, as exposed. Rotate those credentials.
Exploited libraries hide inside vendor updates
Many fleets fast-track only what the vendor's own notes mark as exploited. Apple's notes list CVE-2026-111497 as one line among ten, with no mention that CISA had already put it on the KEV list two weeks earlier. Checking each CVE in a vendor bulletin against the KEV catalog takes minutes and would have flagged this batch on day one.
Our mobile penetration testing covers how corporate iPhones and the apps on them behave against nearby and remote attackers, and safeguarding and hardening includes MDM update and Bluetooth policy. If you want help setting update deadlines for a mixed fleet of iOS 18, 26 and 27 devices, open the chat and Yaali, our AI agent, will pass the question to an engineer.
Sources: Apple security releases, iOS and iPadOS 27.2.1, iOS and iPadOS 26.7.3, iOS and iPadOS 18.7.12, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1, watchOS 26.6.1, visionOS 27.2.1, NVD CVE-2026-113961, NVD CVE-2026-111497, CISA KEV catalog, ITmedia Mobile via Yahoo Japan News, AndroidPure.