Apple Patches 10 Vulnerabilities Across Its Platforms, Including Bluetooth and AirPlay Flaws
Summary
Apple issued updates across iOS, iPadOS, macOS, watchOS and visionOS for 10 flaws, including Bluetooth and AirPlay pairing bypasses and Messages exposure. The releases also patch Node2Shell, targeted in the wild; Apple-product attacks were not indicated.
Key points
- Apple released updates for iOS, iPadOS, macOS, watchOS and visionOS addressing 10 vulnerabilities.
- Several Bluetooth and AirPlay flaws could bypass pairing-code limits or allow pairing without user interaction; some require Bluetooth range, while one requires the same network.
- A Bluetooth use-after-free flaw could allow an attacker within Bluetooth range to corrupt process memory.
- Two Messages flaws could let a remote attacker join an iMessage group and receive messages, or expose earlier group conversations to people added later.
- The updates patch CVE-2026-111497, the Brotli flaw known as Node2Shell, which has been targeted in the wild; the article says there is no indication of attacks against Apple products.
- Other fixes include an App Intents authorization flaw that could expose sensitive user information and a lock-screen AirPlay pairing issue affecting older devices.
Article Details
- Event Type
- Apple security update release
- Impact
- Apple patched 10 vulnerabilities across iOS, iPadOS, macOS, watchOS, and visionOS. The flaws include Bluetooth and AirPlay pairing-code bypasses or pairing without user interaction, potential Bluetooth process-memory corruption, vulnerabilities affecting Messages group-chat privacy, and an App Intents issue that could expose sensitive user information. CVE-2026-111497, the Brotli vulnerability known as Node2Shell, has been targeted in the wild, but the article reports no indication of attacks against Apple products; none of the advisories mention exploitation in the wild.
CVE
CVE-2026-111497Google · Brotli; Siemens · Cloud Connector Configurator; +22 moreThe same releases also fix CVE-2026-111497, the Brotli vulnerability dubbed Node2Shell, which threat actors have targeted in the wild (although there is no indication of attacks against Apple products).CVE-2026-113960Apple · iOS and iPadOS; Apple · macOS; +2 moreThe other, CVE-2026-113960, could expose a group’s earlier conversation to people added later.CVE-2026-113961Apple · iOS and iPadOS; Apple · macOS; +2 moreOne of them, CVE-2026-113961, can allow a remote attacker to join an iMessage group chat and receive its messages.CVE-2026-113963Apple · iOS and iPadOS; Apple · visionOS; +1 moreCVE-2026-113963, an App Intents authorization issue that could give an app access to sensitive user information, is listed only for iOS and iPadOS 27.2.1, watchOS 27.2.1 and visionOS 27.2.1.CVE-2026-113964Apple · iOS and iPadOS; Apple · macOS; +2 moreThe third, CVE-2026-113964 in CoreUtils, pairs the same kind of bypass with a second impact.CVE-2026-113965Apple · iOS and iPadOS; Apple · macOS; +2 moreAnother CoreUtils issue, CVE-2026-113965, is described in similar terms: “A malicious Bluetooth device may be able to establish a pairing without user interaction.”CVE-2026-113968Apple · iOS and iPadOS; Apple · macOS; +2 moreCVE-2026-113968, an AirPlay bug, may be exploitable from Bluetooth range, while CVE-2026-113969, found in the rapportd component, requires the attacker to be on the same network and concerns AirPlay pairing codes.CVE-2026-113969Apple · iOS and iPadOS; Apple · macOS; +2 moreCVE-2026-113968, an AirPlay bug, may be exploitable from Bluetooth range, while CVE-2026-113969, found in the rapportd component, requires the attacker to be on the same network and concerns AirPlay pairing codes.CVE-2026-113970Apple · iOS and iPadOS; Apple · macOS; +2 moreThe fifth is CVE-2026-113970, a use-after-free in Bluetooth that could allow an attacker within Bluetooth range to corrupt process memory.CVE-2026-113971Apple · iOS and iPadOSCVE-2026-113971 appears only in the iOS and iPadOS 18.7.12 advisory, which covers iPhone XS, XS Max, XR and the seventh-generation iPad.
People
Vendors
Products
AirPlayApple on Monday released security updates for iOS, iPadOS, macOS, watchOS and visionOS to patch 10 vulnerabilities, half of them related to Bluetooth and AirPlay pairing.iMessageOne of them, CVE-2026-113961, can allow a remote attacker to join an iMessage group chat and receive its messages.iOSApple on Monday released security updates for iOS, iPadOS, macOS, watchOS and visionOS to patch 10 vulnerabilities, half of them related to Bluetooth and AirPlay pairing.iPadOSApple on Monday released security updates for iOS, iPadOS, macOS, watchOS and visionOS to patch 10 vulnerabilities, half of them related to Bluetooth and AirPlay pairing.macOSApple on Monday released security updates for iOS, iPadOS, macOS, watchOS and visionOS to patch 10 vulnerabilities, half of them related to Bluetooth and AirPlay pairing.MessagesTwo Messages vulnerabilities have been patched in many of the operating systems.visionOSApple on Monday released security updates for iOS, iPadOS, macOS, watchOS and visionOS to patch 10 vulnerabilities, half of them related to Bluetooth and AirPlay pairing.watchOSApple on Monday released security updates for iOS, iPadOS, macOS, watchOS and visionOS to patch 10 vulnerabilities, half of them related to Bluetooth and AirPlay pairing.