Apple released security updates on November 9 for iPhone, iPad, Mac, Apple Watch and Apple Vision Pro. MS-ISAC advisory 2026-129, issued November 10, warns that the most severe vulnerabilities could permit arbitrary code execution. It reports no known exploitation in the wild as of that date.
The fixes address several different attack paths. Examples include Bluetooth memory corruption (CVE-2026-113970), unauthorized Bluetooth pairing, iMessage group-message access (CVE-2026-113961 and CVE-2026-113960), and memory corruption when processing crafted input (CVE-2026-111497). Some issues require nearby Bluetooth access, the same network or physical access; they should not all be described as remotely exploitable without prerequisites.
Applicable releases include iOS and iPadOS 27.2.1, 26.7.3 and 18.7.12; macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3; watchOS 27.2.1 and 26.6.1; and visionOS 27.2.1. Hardware eligibility and the vulnerabilities addressed differ by release.
Inventory managed Apple devices, use Apple's release-specific guidance to select the appropriate update, and install it promptly after suitable testing. Verify the installed version afterward. Apply least privilege and retain endpoint protections; these measures complement rather than replace patching.
Sources: Apple security releases; iOS and iPadOS 27.2.1 security content; macOS Golden Gate 27.2.1 security content.
Attribution: MS-ISAC TLP:CLEAR advisory 2026-129, issued November 10, 2026.