CVE-2026-113968

CVE Enrichment

CVSS: 5.4 MEDIUM
EPSS: 0.32%
EPSS Percentile: 25.51%
CISA KEV: Not listed

Description

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 10-Nov-2026 05:18
Last Modified: 11-Nov-2026 04:51
EPSS Date: 2026-11-10
CWE: CWE-307

CVSS Vector


            CVSS:3.1                            AV:A /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:L /
                            I:L /
                            A:N

CNA Products / Version Status

Apple · iOS and iPadOS Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 18.7.12 — affected (custom)
0 ≤ version < 26.7.3 — affected (custom)
0 ≤ version < 27.2.1 — affected (custom)
Apple · macOS Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 15.8.3 — affected (custom)
0 ≤ version < 26.7.3 — affected (custom)
0 ≤ version < 27.2.1 — affected (custom)
Apple · visionOS Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 27.2.1 — affected (custom)
Apple · watchOS Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 26.6.1 — affected (custom)
0 ≤ version < 27.2.1 — affected (custom)

References

Last enrichment sync: 11-Nov-2026 14:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-113968, an AirPlay bug, may be exploitable from Bluetooth range, while CVE-2026-113969, found in the rapportd component, requires the attacker to be on the same network and concerns AirPlay pairing codes. Apple Patches 10 Vulnerabilities Across Its Platforms, Including Bluetooth and AirPlay Flaws

CVE (9)

People (1)

Vendors (1)

Products (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.