Apple fixes nine flaws in November updates for its devices

Apple released software updates on Monday, 9 November 2026, for iOS and iPadOS, macOS, watchOS and visionOS, fixing nine vulnerabilities, according to SANS Internet Storm Centre Dean of Research Johannes Ullrich. Several flaws affect Bluetooth pairing and could weaken protections intended to limit pairing attempts. Ullrich said Apple’s number of patched vulnerabilities remains small, but the company has increased the frequency of its updates.

The flaws include two Messages vulnerabilities: CVE-2026-113960 could let a person added to an iMessage group see messages sent before they joined, while CVE-2026-113961 could let a remote attacker join a group chat and receive its messages. Bluetooth issues include CVE-2026-113964, which could let an attacker within Bluetooth range bypass pairing-code attempt limits and pair without user interaction, and CVE-2026-113965, which could allow a malicious Bluetooth device to pair without interaction.

Separate AirPlay flaws could bypass pairing-code limits from Bluetooth range (CVE-2026-113968) or from the same network (CVE-2026-113969). CVE-2026-113970 could allow an attacker in Bluetooth range to corrupt process memory.

Other fixes address CVE-2026-113963, which could allow an app to access sensitive user data, and CVE-2026-113971, which could let someone with physical access pair a device with an AirPlay receiver from the lock screen. Ullrich said the latter affects only iOS and iPadOS 18.7.12. Apple’s listed updates include iOS/iPadOS 27.2.1, 26.7.3 and 18.7.12; macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3; watchOS 27.2.1 and 26.6.1; and visionOS 27.2.1.