# Apple patches nine flaws across OS lineup

Published: 2026-11-10 · Severity: routine
Canonical: https://vorant.io/reports/4bfb724e-bef0-5bf5-9aa1-b4623852921a/apple-patches-nine-flaws-across-os-lineup
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Apple fixed nine vulnerabilities in iOS, iPadOS, macOS, watchOS and visionOS, including Bluetooth/AirPlay pairing bypasses and an iMessage group-chat flaw.

Source: isc.sans.edu — https://isc.sans.edu/diary/rss/33506

## What to check

- Applies to: The 9 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

Apple released its November 2026 update round for iOS/iPadOS, macOS, watchOS, and visionOS, addressing nine vulnerabilities across the platforms. Two issues affect Messages: CVE-2026-113960 could let a newly added iMessage group member view messages sent before they joined, and CVE-2026-113961 could allow a remote attacker to join an iMessage group chat and receive its messages. CVE-2026-113963 could let a malicious app access sensitive user data via App Intents.

A cluster of Bluetooth/AirPlay-related flaws stands out: CVE-2026-113964 and CVE-2026-113968 allow an attacker in Bluetooth range to bypass rate limiting on pairing code attempts (CoreUtils and AirPlay respectively), CVE-2026-113965 allows a malicious Bluetooth device to pair without user interaction, CVE-2026-113969 lets a network-adjacent attacker bypass AirPlay pairing code rate limits via rapportd, and CVE-2026-113970 could allow Bluetooth-range memory corruption. CVE-2026-113971, affecting only iOS/iPadOS 26, allows an attacker with physical access to pair a device with an AirPlay receiver directly from the lock screen.

No in-the-wild exploitation is reported; this is a routine patch cycle. Apple has reportedly increased its update cadence. Defenders should ensure devices are updated to iOS 27.2.1/iPadOS 27.2.1, iOS 26.7.3/iPadOS 26.7.3, iOS 18.7.12/iPadOS 18.7.12, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1/26.6.1, and visionOS 27.2.1 as applicable to close off the Bluetooth/AirPlay pairing bypasses and messaging data-exposure issues.

## Mentioned in this report

- Vulnerabilities: CVE-2026-113960, CVE-2026-113961, CVE-2026-113963, CVE-2026-113964, CVE-2026-113965, CVE-2026-113968, CVE-2026-113969, CVE-2026-113970, CVE-2026-113971

Source reporting: https://isc.sans.edu/diary/rss/33506

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4bfb724e-bef0-5bf5-9aa1-b4623852921a/apple-patches-nine-flaws-across-os-lineup.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup