Apple Patches Everyting: November 2026 Edition - SANS ISC
Our summary
Apple shipped a fresh round of security updates on Monday for iOS/iPadOS, macOS, watchOS, and visionOS, addressing a total of nine flaws. Most of the bugs involve Bluetooth and AirPlay pairing mechanisms, where an attacker within range could bypass pairing-code rate limits or even pair with a device without any user interaction, as described in CVE-2026-113964, CVE-2026-113965, CVE-2026-113968, and CVE-2026-113969. Other fixes cover iMessage group chat issues (CVE-2026-113960 and CVE-2026-113961) that could expose prior messages or let an outsider join a conversation, an App Intents data-exposure bug (CVE-2026-113963), a memory-corruption flaw in Bluetooth (CVE-2026-113970), and a lock-screen AirPlay pairing issue limited to iOS/iPadOS 26 (CVE-2026-113971). The patched releases include iOS/iPadOS 27.2.1, 26.7.3, and 18.7.12, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1 and 26.6.1, and visionOS 27.2.1, and users should update promptly given the device-pairing risks involved.
Below is the opening; the full story is at SANS Internet Storm Center.
From SANS Internet Storm Center
On Monday, Apple released updates for iOS/iPadOS, macOS, watchOS, and visionOS. These updates fix nine different vulnerabilities. One of the vulnerabilities, CVE-2026-113971, applies only to iOS/iPadOS version 26. Several of the vulnerabilities apply to Bluetooth issues that may weaken the device pairing process.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.