Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-113965

Bluetooth pairing without user interaction on Apple devices

CVSS 3.1
5.4 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-113965 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

A Bluetooth pairing flaw on Apple platforms lets a malicious Bluetooth device pair without user interaction. An attacker within Bluetooth range needs no account and no victim action. Pairing can affect confidentiality and integrity of the device. The issue is fixed in stated releases of iOS, iPadOS, macOS, visionOS, and watchOS; Apple has not listed affected build ranges.

What to do: Update to iOS/iPadOS 18.7.12, 26.7.3, or 27.2.1; macOS Sequoia 15.8.3, Tahoe 26.7.3, or Golden Gate 27.2.1; visionOS 27.2.1; watchOS 26.6.1 or 27.2.1.

ProductAffectedFixed in
Apple iOS—18.7.12, 26.7.3, 27.2.1
Apple iPadOS—18.7.12, 26.7.3, 27.2.1
Apple macOS Golden Gate—27.2.1
Apple macOS Sequoia—15.8.3
Apple macOS Tahoe—26.7.3
Apple visionOS—27.2.1
Apple watchOS—26.6.1, 27.2.1
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction.

Weakness
CWE-287
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD CVE.org GitHub PoCs EPSS (—)

In the news

4 stories