Apple's 27.2.1 update closes Bluetooth pairing and iMessage group flaws

Apple's 27.2.1 update closes Bluetooth pairing and iMessage group flaws

9 November 2026: Apple has shipped iOS and iPadOS 27.2.1 with nine security fixes, the most striking being a flaw that let a malicious Bluetooth device pair with an iPhone with no user interaction and another that let a remote attacker join an iMessage group chat and receive its messages. Fleet managers should treat it as a required update even though Apple reports no exploitation.

Not yet independently verified. We read Apple's content page for iOS and iPadOS 27.2.1 only, so the fixes in the macOS, watchOS, visionOS and backported releases may differ from the list here. Apple's page does not say any of these flaws has been exploited. We will update this when it can be confirmed, and remove this note.

The releases and what they cover

Apple's security releases page lists the following from the same day:

• iOS 27.2.1 and iPadOS 27.2.1
• iOS 26.7.3 and iPadOS 26.7.3
• iOS 18.7.12 and iPadOS 18.7.12
• macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3
• watchOS 27.2.1 and watchOS 26.6.1
• visionOS 27.2.1

The iOS 27.2.1 build runs on iPhone 11 and later and on the iPad Pro, Air, standard and mini models that Apple names. Older phones get the backport lines.

Nearby attackers and the pairing code limit

Five of the nine fixes concern radios and pairing, which makes physical proximity the main threat. CVE-2026-113965 in CoreUtils is the zero-click pairing bug. CVE-2026-113964, also in CoreUtils, lets an attacker in Bluetooth range get past the rate limit on pairing codes and pair with no user action. CVE-2026-113968 does the same for AirPlay pairing codes from Bluetooth range, and CVE-2026-113969 in rapportd does it from the same network. CVE-2026-113970 is a use-after-free in Bluetooth that can corrupt process memory.

An office, an airport lounge or a trade show floor is the natural setting for this class of bug, which is the practical reason to push the update to staff phones before the next round of travel.

Group chats that were not as closed as they looked

Two fixes in Messages affect anyone who discusses company business in iMessage groups. CVE-2026-113961 allowed a remote attacker to join a group chat and receive its messages, an authorization issue Apple says it addressed with improved validation. CVE-2026-113960 let a person added to a group read messages sent before they joined, and Apple removed the vulnerable code.

The second one has a data-handling angle. A group that added a contractor or a new hire may have exposed its earlier history to that person, and Apple's page gives no date from which the behaviour began.

The remaining fixes

CVE-2026-113963 in App Intents was an authorization issue that could let an app reach sensitive user data. CVE-2026-111497 is an out-of-bounds write in brotli, the compression library, triggered by crafted input. The same number has appeared in Microsoft's .NET out-of-band release and other vendors' advisories.

Apple's previous release, iOS 27.2 and the 18.7.11 backport, carried 163 identifiers and a possibly exploited CoreGraphics flaw, which is a further reason not to leave devices behind on an older build.

Related on TrustList:

• Android November bulletin fixes a zero-click Framework flaw
• Apple backports fix for possibly exploited CoreGraphics bug to iOS 18

Sources

• Apple, About the security content of iOS 27.2.1 and iPadOS 27.2.1, 9 November 2026
• Apple security releases, 9 November 2026