CERT-FR Flags Multiple Apple Product Vulnerabilities
CERT-FR advisory lists multiple vulnerabilities across iOS, iPadOS, macOS, watchOS and visionOS requiring updates to latest versions.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 10 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-111497 as exploited in the wild.
CERT-FR published an advisory consolidating multiple Apple security bulletins dated 9 November 2026, covering vulnerabilities across iOS, iPadOS, macOS (Golden Gate, Sequoia, Tahoe), visionOS and watchOS. The flaws can lead to breaches of data confidentiality and integrity, as well as bypass of security policy mechanisms. No evidence of active exploitation is mentioned in the advisory.
Affected versions span iOS/iPadOS prior to 18.7.12, 26.7.3, and 27.2.1; macOS Sequoia prior to 15.8.3; macOS Tahoe prior to 26.7.3; macOS Golden Gate prior to 27.2.1; watchOS prior to 26.6.1 and 27.2.1; and visionOS prior to 27.2.1. Ten CVEs are referenced (CVE-2026-111497, CVE-2026-113960, CVE-2026-113961, CVE-2026-113963 through CVE-2026-113965, CVE-2026-113968 through CVE-2026-113971) without detailed technical descriptions in the advisory text itself.
Defenders managing Apple device fleets should prioritize patching to the versions specified above. Full technical details and patches are available via Apple's own security bulletins linked in the advisory. This is a routine CERT-FR vulnerability bulletin aggregating vendor patches rather than a report of active exploitation.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1487
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs