Apple released iOS 27.2.1, iPadOS 27.2.1, and macOS Golden Gate 27.2.1 on 9 November 2026. The updates fix two iMessage group chat flaws and Bluetooth pairing bugs. The fixes are listed in Apple’s security notes.
Install it now if you have an iPhone, iPad, or Mac. Apple says a remote attacker may be able to join an iMessage group chat and receive its messages. The fix is what Apple calls improved validation.
The second iMessage flaw, CVE-2026-113960, may let a user added to a group access messages sent before they joined. Apple removed the vulnerable code to fix it. Both iMessage flaws are credited to an anonymous researcher.
CVE-2026-113965 covers a malicious Bluetooth device that may be able to pair without any user interaction. CVE-2026-113964, also credited to an anonymous researcher, may let an attacker in Bluetooth range bypass the rate limit on pairing-code attempts and pair without user interaction. CVE-2026-113970 may let an attacker in range corrupt process memory.
AirPlay pairing codes are also covered. An attacker in Bluetooth range may be able to bypass the rate limit on AirPlay pairing-code attempts (CVE-2026-113968). An attacker on the same network may do the same through rapportd (CVE-2026-113969). Two more fixes sit outside those groups. CVE-2026-113963 in App Intents may let an app access sensitive user data. The Brotli flaw, CVE-2026-111497, may lead to memory corruption when it processes maliciously crafted input. The Hacker News reports that the US Cybersecurity and Infrastructure Security Agency (CISA) added the Brotli flaw to its Known Exploited Vulnerabilities catalog on 27 October.
Apple lists the iOS and iPadOS fixes for these devices:
- iPhone 11 and later
- iPad Pro 12.9-inch (4th generation) and later
- iPad Pro 11-inch (2nd generation) and later
- iPad Air (4th generation) and later
- iPad (9th generation) and later
- iPad mini (6th generation) and later
The iPhone XS, iPhone XS Max, iPhone XR, and iPad (7th generation) don’t list either iMessage fix in the same-day updates. The Hacker News says Apple doesn’t say whether those devices are affected.
Apple’s iOS 18.7.12 notes list other security fixes, but not the iMessage or Brotli ones.
Apple’s notes don’t say whether either iMessage flaw has been exploited, but they also don’t say what an attacker would need. Nor do they say whether group members would see someone who joined this way, or whether every member must update to be protected. There’s no workaround in the notes for anyone who can’t update straight away.
MacRumors reports that macOS Golden Gate 27.2.1 is a minor update, released the same day. AppleMagazine counts eight of the nine iOS vulnerabilities in the macOS bulletin, and the App Intents fix isn’t one of them. macOS Golden Gate runs only on Apple silicon Macs.
These are point releases, roughly two weeks after Apple’s feature-rich 27.2 releases of 26 October. In July, Apple’s iOS 26.6 and iPadOS 26.6 updates patched 97 vulnerabilities.
How to update
On an iPhone or iPad, go to Settings → General → Software Update. The steps match those for the iOS 26.6.2 cellular update fix. On a Mac, choose System Settings from the Apple menu, then General, then Software Update. AppleVis recommends a full backup first, and keeping the device plugged in while the update installs.
