Apple Releases iOS 27.2.1 to Fix iMessage and Bluetooth Flaws

Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026, to address nine security vulnerabilities, including two flaws that could allow unauthorized access to iMessage group chats.

The updates extend across the company’s ecosystem, covering Mac, Apple Watch, and Vision Pro devices as well.

The update resolves two specific issues within the Messages application. One vulnerability, tracked as CVE-2026-113961, involves an authorization flaw that could permit a remote attacker to join a group chat without an invitation and receive its messages. Apple addressed this by removing the vulnerable code.

A second, separate issue—CVE-2026-113960—allowed participants added to a group to view messages sent before they joined. The company notes that these vulnerabilities were credited to an anonymous researcher. Apple has not disclosed whether these flaws were exploited in the wild, nor has it identified specific affected users or conversations.

Apple's security notes state that “A remote attacker may be able to join an iMessage group chat and receive its messages”.

Beyond messaging, the latest software updates target several wireless security weaknesses. Two vulnerabilities involving CoreUtils could allow a malicious Bluetooth device to pair with a user’s hardware without interaction. Apple documented these under CVE-2026-113965 and CVE-2026-113964, noting that the issues were corrected through improved state management and checks. One CoreUtils flaw is credited to Apple, while the other is credited to an anonymous researcher.

These issues are tracked as CVE-2026-113968 and CVE-2026-113969, which relate to AirPlay pairing code rate limits. The updates also include a fix for a Brotli data compression library flaw (CVE-2026-111497), an out-of-bounds write issue in the library’s decoder that could let malicious input corrupt memory.

An App Intents authorization issue was addressed with improved state management to prevent apps from accessing sensitive user data, though this specific fix does not appear in the macOS bulletin.

The security fixes were distributed across multiple platforms on November 9, 2026. macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, and macOS Golden Gate 27.2.1 were issued to Mac. The Apple Watch received watchOS 27.2.1 and watchOS 26.6.1, while the Vision Pro received visionOS 27.2.1.

Because Apple’s operating systems share significant blocks of code, many patches are identical across platforms. Apple did note that the macOS Golden Gate 27.2.1 update includes eight of the nine CVEs, with the App Intents issue being the exception.

These security updates are compatible with a broad assortment of hardware, including the iPhone 11 and later, iPad Pro 12.9-inch (4th generation) and later, iPad Pro 11-inch (2nd generation) and later, iPad Air (4th generation) and later, iPad (9th generation) and later, as well as the iPad mini (6th generation) and later.

Mac users should go to System Settings, select General, and choose Software Update. Apple advises that while they have not reported observed exploitation, the public nature of these vulnerability details makes it important for users to update their devices as soon as possible to maintain a secure user experience.

More on Apple: Apple Launches AI Conversation Tools for Apple Watch in Beta Testing · Apple Directs Affected iPhone Duo Owners to AppleCare for Replacement · Apple Announces New MacBook Pro With Built-In Touchscreen Display