Apple patches iMessage group-chat flaws and Bluetooth pairing bugs
iOS and iPadOS 27.2.1 also fix Brotli CVE-2026-111497, which CISA added to the Known Exploited Vulnerabilities catalog on October 27.
73
CVE-2026-113961
Incorrect authorization lets a remote attacker join iMessage groups
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An authorization flaw in Apple’s iMessage handling lets a remote attacker join an iMessage group chat and receive its messages, with no authentication or user interaction required. The issue is fixed with improved validation on iOS, iPadOS, macOS, visionOS, and watchOS. Apple has not listed affected builds, only the versions that contain the fix.
What to do: Update to iOS/iPadOS 26.7.3 or 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, macOS Golden Gate 27.2.1, visionOS 27.2.1, or watchOS 27.2.1.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 26.7.3 and 27.2.1 |
| Apple iPadOS | — | 26.7.3 and 27.2.1 |
| Apple macOS Golden Gate | — | 27.2.1 |
| Apple macOS Sequoia | — | 15.8.3 |
| Apple macOS Tahoe | — | 26.7.3 |
| Apple visionOS | — | 27.2.1 |
| Apple watchOS | — | 27.2.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and receive its messages.
- Weakness
- CWE-863
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
In the news
5 storiesApple patches Bluetooth and AirPlay pairing flaws across platforms
Ten fixes cover current and older Apple releases; advisories do not report exploitation of the Apple issues.
68
Apple patches nine flaws across iOS, macOS, watchOS and visionOS
Updates cover iMessage group access, Bluetooth and AirPlay pairing-code bypasses, and one lock-screen AirPlay issue limited to iOS/iPadOS 26.
64
Apple patches nine iOS 27.2.1 and iPadOS 27.2.1 flaws, none exploited
Fixes include Bluetooth pairing-limit bypasses, AirPlay flaws, and iMessage group access; Apple reports no real-world use.
64
Apple iOS 27.2.1 fixes nine flaws in iMessage, Bluetooth, and AirPlay
The same release covers iPadOS 27.2.1; Apple does not say any of the nine flaws are exploited.
62