# Apple patches multiple iOS, macOS vulnerabilities

Published: 2026-11-10 · Severity: severe · Sectors: Government (National), Technology
Canonical: https://vorant.io/reports/3403d20c-9c45-5926-a09e-c8855ee6eaac/apple-patches-multiple-ios-macos-vulnerabilities
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CIS/MS-ISAC advisory details multiple Apple vulnerabilities, including Bluetooth and AirPlay pairing flaws, allowing arbitrary code execution; no known exploitation.

Source: cisecurity.org — https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2026-129

## What to check

- Applies to: The 10 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-111497 as exploited in the wild.

MS-ISAC issued an advisory covering multiple vulnerabilities across Apple's product line, the most severe of which could allow arbitrary code execution. Affected products include versions prior to iOS/iPadOS 27.2.1, iOS/iPadOS 26.7.3, iOS/iPadOS 18.7.12, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1, watchOS 26.6.1, and visionOS 27.2.1. Impact depends on user privileges; accounts with fewer rights would be less affected than those with administrative privileges.

Notable issues include Bluetooth pairing rate-limit bypasses that could allow an attacker in range to pair with a device without user interaction (CVE-2026-113964, CVE-2026-113965), Bluetooth memory corruption (CVE-2026-113970), an AirPlay pairing rate-limit bypass (CVE-2026-113969), a lock-screen AirPlay pairing issue requiring physical access (CVE-2026-113971), and iMessage group chat flaws allowing unauthorized access to group messages (CVE-2026-113961, CVE-2026-113960). Additional issues include sensitive data access by apps (CVE-2026-113963) and memory corruption from crafted input (CVE-2026-111497).

MS-ISAC states there are currently no reports of these vulnerabilities being exploited in the wild. Defenders are advised to apply Apple's updates promptly, enforce least privilege, enable anti-exploitation features (SIP, Gatekeeper), and maintain standard patch management processes.

## Mentioned in this report

- Vulnerabilities: CVE-2026-111497 (KEV), CVE-2026-113960, CVE-2026-113961, CVE-2026-113963, CVE-2026-113964, CVE-2026-113965, CVE-2026-113968, CVE-2026-113969, CVE-2026-113970, CVE-2026-113971

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2026-129

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3403d20c-9c45-5926-a09e-c8855ee6eaac/apple-patches-multiple-ios-macos-vulnerabilities.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup