621/69 Wednesday, November 11, 2026
Apple has released security updates addressing two vulnerabilities in iMessage that could affect user privacy. CVE-2026-113961 could allow an attacker to join a group conversation and receive messages without authorization, while CVE-2026-113960 could allow a newly added group member to access messages sent before they joined the conversation. Apple has not disclosed detailed exploitation conditions for either vulnerability, and there are currently no confirmed reports that the flaws have been exploited in the wild.
CVE-2026-113961 is caused by improper authorization handling in the Messages component and was addressed by improving data validation. CVE-2026-113960 was fixed by removing the vulnerable code. Apple also patched CVE-2026-113965 and CVE-2026-113964 in CoreUtils, which could allow an attacker within Bluetooth range to pair with a device without user confirmation. In addition, CVE-2026-113969 in AirPlay could allow an attacker on the same network to bypass limits on pairing-code attempts, while CVE-2026-111497 in the Brotli library could cause memory corruption when processing specially crafted data.
Users should check for and install the appropriate security updates for their devices, including iOS and iPadOS 27.2.1 or 26.7.3, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1, and visionOS 27.2.1, all of which include fixes for the two iMessage vulnerabilities. Updates can be installed through the Software Update menu. However, Apple’s advisories for iOS and iPadOS 18.7.12 and watchOS 26.6.1 for some older devices do not currently list fixes for these vulnerabilities, so users should continue monitoring Apple’s security advisories for further updates. Enterprise administrators should also verify device versions and update status across managed environments to reduce exposure to these vulnerabilities.
Source: https://thehackernews.com/2026/11/apple-patches-imessage-group-chat.html