CVE-2026-113960

No known exploitation. EPSS puts it in the 30th percentile. Fixed versions are out.

CVSS 3.16.5Medium EPSS percentile30th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix5 products4 fixed builds listed below

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-11-09Updated 2026-11-12Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Apple HomeView SoftwareAffected: < 27.2Upgrade to: 27.2Stated by: CVE record
Apple iOS and iPadOSAffected: < 26.7.3Upgrade to: 26.7.3Affected: < 27.2.1Upgrade to: 27.2.1Stated by: CVE record
Apple macOSAffected: < 15.8.3Upgrade to: 15.8.3Affected: < 26.7.3Upgrade to: 26.7.3Affected: < 27.2.1Upgrade to: 27.2.1Stated by: CVE record
Apple visionOSAffected: < 27.2.1Upgrade to: 27.2.1Stated by: CVE record
Apple watchOSAffected: < 27.2.1Upgrade to: 27.2.1Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which Apple devices your business uses (iPhones, iPads, Macs, Apple Watches, Vision Pro) and their current software version.
If any device is below the fixed version, open Settings > General > Software Update (or System Settings on Mac).
Install the latest update: iOS/iPadOS 26.7.3 or 27.2.1, macOS 15.8.3 or 26.7.3/27.2.1, watchOS 27.2.1, or visionOS 27.2.1, whichever applies to your device.
Avoid adding new members to sensitive iMessage group chats until updated, since they could see the group's prior message history.

Usually a quick update

What it is

From the CVE record

This issue was addressed by removing the vulnerable code. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined.

In plain language

Written by AI from the record

A bug in Apple's Messages app could let someone newly added to an iMessage group see older messages they shouldn't — it's fixed in the latest Apple software updates, and there's no sign anyone is exploiting it, so this is low-priority but worth updating when convenient.

Logic flaw in iMessage group chat membership handling allows a newly added participant to retrieve messages sent prior to their addition, fixed by removing the vulnerable code in iOS/iPadOS 26.7.3 & 27.2.1, macOS 15.8.3/26.7.3/27.2.1, visionOS 27.2.1, and watchOS 27.2.1.

If you're affected

Internal conversation exposure
Accidental data leak to new group members
Confidentiality breach via Messages app

What is it

Think of a private group chat where someone new joins and, instead of only seeing messages from that point forward, they can scroll back and read everything said before they were added. That's essentially what this bug allowed in Apple's Messages app. Apple has removed the faulty code so new group members can no longer peek at history they weren't part of.

Who is affected

This applies if your business or staff use iMessage group chats on iPhone, iPad, Mac, Apple Watch, or Vision Pro. It matters most if you use group messages to discuss sensitive business information and regularly add new people to existing threads.

How urgent is it

There are no reports of this being exploited anywhere, no public attack code exists, and it isn't on any government list of actively-abused vulnerabilities. This is a low-urgency issue — update through your normal device update routine rather than treating it as an emergency.

What to do — in detail

Confirm exposure by checking OS/build versions on all organizational Apple devices (iPhone, iPad, Mac, Apple Watch, Vision Pro) against the fixed releases: iOS/iPadOS 26.7.3, iOS/iPadOS 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, macOS Golden Gate 27.2.1, watchOS 27.2.1, visionOS 27.2.1. There is no reported workaround other than avoiding adding new participants to sensitive existing group threads until patched, since the flaw stems from removed (flawed) logic rather than a configurable setting. Roll out updates via standard MDM/software-update channels; no CISA KEV deadline applies since this is not in the Known Exploited Vulnerabilities catalog. Monitor Apple's security update notes for any follow-up advisories referencing this CVE, though no further exploitation signals are currently expected given the flat, low EPSS trend.

Technical context

Severity is modest: no KEV listing, no public exploit code, and EPSS scoring places likelihood of exploitation in the wild in roughly the 8th percentile with a flat trend — consistent with a low-severity, local-logic information-disclosure issue rather than a remotely exploitable flaw. The weakness is an access-control/logic defect in iMessage group membership handling (not injection or memory corruption), remediated by code removal rather than a configuration change. Exploit maturity is effectively nil; press attention is newly emerging but reflects disclosure coverage, not active attacks.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS30th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 30th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 3 days, from the signal feeds we watch.

2026-11-12Record updatedrecord updated
2026-11-10Record updated
2026-11-09Publishedweakness classified, record updated

Affected products

Applecommercial · USaka apple computer, apple inc.
- HomeView SoftwareOn-premMobile Apps / ios-app
- iOS and iPadOSOSEmbeddedOperating Systems / mobile-os
- macOSOSOn-premOperating Systems / unix-bsd
- visionOSOSOperating Systems / mobile-os
- watchOSOSEmbeddedOperating Systems / mobile-os

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact