Apple has rolled out crucial security updates for its range of operating systems, including iOS, iPadOS, macOS, watchOS, and visionOS, to address multiple vulnerabilities. These updates, announced on Monday, target ten specific flaws, with a significant focus on Bluetooth and AirPlay pairing issues.
Comprehensive Security Enhancements
The recent updates apply to several versions: iOS and iPadOS 27.2.1, 26.7.3, and 18.7.12; macOS Golden Gate 27.2.1, Tahoe 26.7.3, and Sequoia 15.8.3; watchOS 27.2.1 and 26.6.1; and visionOS 27.2.1. Five of these vulnerabilities are common across these platforms, notably those that affect the Bluetooth and AirPlay features.
Three significant issues involve the restriction of pairing code attempts. The AirPlay bug, identified as CVE-2026-113968, can be exploited within Bluetooth range. Another flaw, CVE-2026-113969, affects the rapportd component, requiring the attacker to be on the same network, focusing on AirPlay pairing codes.
Bluetooth Vulnerabilities in Focus
Another critical issue, CVE-2026-113964 in CoreUtils, allows attackers within Bluetooth range to bypass restrictions on pairing code attempts, potentially pairing with a device without user authentication. A related vulnerability, CVE-2026-113965, suggests that a malicious Bluetooth device can initiate pairing without user consent.
The final Bluetooth-related vulnerability, CVE-2026-113970, is a use-after-free flaw that could enable attackers within range to corrupt process memory. These vulnerabilities highlight the need for enhanced security measures in wireless communication technologies.
Additional Security Concerns
In addition to Bluetooth and AirPlay issues, Apple has addressed two vulnerabilities in the Messages app. CVE-2026-113961 allows remote attackers to infiltrate group chats, while CVE-2026-113960 could expose previous conversations to new participants. Another significant flaw, CVE-2026-111497, known as Node2Shell, has also been mitigated, despite no known attacks on Apple devices.
Specific vulnerabilities pertain to certain platforms. CVE-2026-113963 affects App Intents, potentially granting apps access to sensitive data, and is confined to iOS, iPadOS 27.2.1, watchOS 27.2.1, and visionOS 27.2.1. Meanwhile, CVE-2026-113971 affects iOS and iPadOS 18.7.12, allowing unauthorized pairing from the lock screen.
Apple has credited its internal team for discovering five vulnerabilities. An anonymous researcher identified the Messages vulnerabilities and CVE-2026-113964, while László Várady reported the App Intents issue. Apple’s advisories do not indicate any active exploitation of these vulnerabilities in the wild. More detailed information can be found on Apple’s Security Releases page.
