CVE-2026-113961

Think of an iMessage group chat like a private meeting room with a guest list. This flaw is like a broken door lock that lets a stranger walk into the meeting and listen in, even though they were never invited. Apple has fixed the lock in the latest updates.

This matters to you if your business uses iPhones, iPads, Macs, Apple Watches, or Vision Pro devices and relies on iMessage group chats for communication. No special settings or attacker access are needed — the issue affects the messaging feature itself whenever it's in use.

There's no evidence yet that attackers are exploiting this in the wild, and no public exploit code exists, so this isn't an active emergency. Still, it affects a widely used communication feature on Apple devices, so you should schedule the update soon rather than delay indefinitely.

Confirm exposure by identifying all Apple devices (iPhone, iPad, Mac, Apple Watch, Vision Pro) in your fleet and their OS versions. Target fixed versions: iOS/iPadOS 26.7.3 or 27.2.1; macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, or macOS Golden Gate 27.2.1 (depending on which macOS branch you run); watchOS 27.2.1; visionOS 27.2.1. There is no documented workaround since the fix is an authorization-check correction inside iMessage's group chat membership handling — the only mitigation is applying the update via standard OS update channels (Settings > General > Software Update, or MDM push for managed fleets). No CISA KEV listing exists and there's no CISA-mandated remediation date. Monitor Apple's security update feed for any follow-up advisories referencing this CVE, and verify fleet compliance via MDM reporting after rollout.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects high confidentiality impact via network-exploitable access with no privileges or user interaction required, but no integrity or availability impact. The weakness is CWE-863 (Incorrect Authorization) — iMessage's group chat join/membership validation failed to properly restrict participation, permitting unauthorized remote joining and message interception. No KEV listing, no public exploit code, and EPSS places predicted exploitation likelihood at the median (50th percentile) with a flat trend, consistent with no confirmed in-the-wild activity. Press attention is newly emerging but reflects coverage rather than exploitation evidence.