On November 9, 2026, Apple released a series of security updates that fix eight vulnerabilities in iMessage, Bluetooth, AirPlay and Google’s Brotli compression library. The most notable issue — CVE-2026-113961 — allowed a remote attacker to join an iMessage group chat and receive its messages. The updates are available for iOS/iPadOS 27.2.1, macOS Golden Gate 27.2.1 and watchOS 26.6.1, but the coverage of fixes varies across platforms: devices running iOS 18.7.12 and some Apple Watch models did not receive patches for iMessage and Brotli.
iMessage vulnerabilities: unauthorized access to group chats
According to Apple’s security advisory for iOS/iPadOS 27.2.1, two vulnerabilities in the Messages component have been fixed:
- CVE-2026-113961 — an authorization flaw that allowed a remote attacker to join an iMessage group chat and receive its messages. Apple addressed the issue through improved validation.
- CVE-2026-113960 — a vulnerability that allowed a user added to a group to access messages sent before they joined. It was fixed by removing the vulnerable code.
Apple does not disclose whether these vulnerabilities have been exploited, what preconditions an attacker needs, whether group members can see a user who joined without authorization, or whether all chat participants must update their devices to be protected. These information gaps make it significantly harder to assess the actual risk.
CVE-2026-111497: critical Brotli vulnerability from the CISA KEV catalog
Among the fixed vulnerabilities, CVE-2026-111497 deserves priority attention. This is an out-of-bounds write flaw in the decoder of Google’s Brotli compression library that can lead to memory corruption when processing specially crafted data. The CNA (Google Inc.) rates the vulnerability under CVSS 4.0 at 9.2 — Critical.
According to NVD, the vulnerability affects Google Brotli versions 1.0.3 through 1.0.10, 1.1.0 through 1.1.1, and 1.2.0 through 1.2.1. CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog on October 27, 2026, with a remediation deadline of November 10, 2026 — meaning the deadline practically coincided with Apple’s release of updates.
CVE-2026-111497 should receive the highest patching priority in this update package: it is the only one of the eight vulnerabilities with confirmed CISA KEV status and a critical CVSS rating. There is no such confirmation of exploitation for the iMessage and Bluetooth vulnerabilities. We have already covered this vulnerability in the context of its ecosystem impact — Brotli is used in numerous products, from Node.js to server-side proxies.
Bluetooth and AirPlay vulnerabilities
All nine released updates, including watchOS 26.6.1, contain fixes for five vulnerabilities in the Bluetooth and AirPlay subsystems:
- CVE-2026-113965 — a malicious Bluetooth device could establish pairing without user interaction.
- CVE-2026-113964 — an attacker within Bluetooth range could bypass the limit on the number of pairing code entry attempts and connect without user involvement.
- CVE-2026-113968 — bypass of the rate limit for pairing code entry attempts from within Bluetooth range.
- CVE-2026-113969 — bypass of the rate limit for AirPlay pairing code entry attempts from the same network.
- CVE-2026-113970 — a use-after-free bug that allowed an attacker within Bluetooth range to corrupt process memory.
Apple does not specify what actions become available to an attacker after unauthorized pairing.
Coverage matrix: not all platforms are equally protected
An important aspect of this update is the uneven distribution of fixes across platforms. iOS/iPadOS 27.2.1 (for iPhone 11 and newer, as well as the listed iPad models) and macOS Golden Gate 27.2.1 include all three groups of fixes: iMessage, Brotli, and Bluetooth/AirPlay. However, watchOS 26.6.1 contains only Bluetooth and AirPlay fixes — with no patches for iMessage and Brotli. The iOS 18.7.12 updates for the iPhone XS, XS Max, XR and 7th‑generation iPad likewise do not include iMessage and Brotli fixes.
Apple does not clarify whether devices on these OS branches are affected by the listed vulnerabilities or are not impacted to begin with. The absence of a fix in an advisory is not equivalent to the absence of a vulnerability.
Recommendations
- Update immediately to iOS/iPadOS 27.2.1 and macOS Golden Gate 27.2.1 — these versions close all eight vulnerabilities, including the critical CVE-2026-111497 with the CISA KEV deadline of November 10.
- Update Apple Watch to watchOS 26.6.1 to eliminate the Bluetooth and AirPlay vulnerabilities.
- For devices on iOS 18.7.12 that did not receive iMessage and Brotli fixes, Apple does not offer any workarounds. The full list of updates is available on the Apple security releases page.
- Organizations using Brotli in their server infrastructure should check library versions in all products — the vulnerability affects not only Apple but any software that includes Brotli in the affected versions.
Patching priority is straightforward: CVE-2026-111497 in Brotli is the only vulnerability in this package with confirmed exploitation and a critical CVSS-B 9.2 rating, and its CISA KEV deadline has already passed. Devices running iOS/iPadOS 27.2.1 and macOS Golden Gate 27.2.1 should be updated first, and for devices on older OS branches you should monitor for additional Apple advisories.
