CVE-2026-113971Not scored

CVE-2026-113971: Apple iOS and iPadOS vulnerability

Apple · iOS and iPadOS

Vendor fix available · Affected: Apple iOS and iPadOS · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not establishedNothing in the sources we check

0.2%probability of exploitation in the next 30 days

5th percentile

050100

Higher than 5% of scored CVEs

Not scored yet. NVD has not published a CVSS score.

DescriptionNVD

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Access Control · Access Control
Vendor: Apple
Published: November 2026
Band: Unlikely (under 1%), November 2026

Coverage2 articles · 2 outlets

One row per outlet, in order of first report. First in our coverage: SANS ISC, 10 Nov.

Full timeline

Quiet for 4 dayslast report 11 Nov2 articles2 outlets

First report
Article
Running total

Show as table

2 articles about CVE-2026-113971 from 2 outlets
Published (UTC)	Outlet	Headline
10 Nov 14:01	SANS ISC	Apple fixes nine flaws in November updates for its devices
11 Nov 08:01	SecurityWeek	Apple patches Bluetooth and AirPlay pairing flaws across platforms

11 Nov 08:01
Apple patches Bluetooth and AirPlay pairing flaws across platforms
SecurityWeek · mentions it in passing
10 Nov 14:01
Apple fixes nine flaws in November updates for its devices
SANS ISC · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.