Apple Issues iOS 27.2.1 Fixes for Bluetooth and iMessage Flaws

Apple has released iOS 27.2.1 and iPadOS 27.2.1, a security update dated 9 November 2026, that fixes Bluetooth pairing flaws and two problems in iMessage group chats. The iOS note is available for iPhone 11 and later, and for a listed set of iPads. Apple has not said that any of the flaws have been exploited, and this is not a zero-day advisory.

Matching updates are out the same day for other Apple systems, including iOS and iPadOS 26.7.3, iOS and iPadOS 18.7.12, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1, watchOS 26.6.1 and visionOS 27.2.1. Those notes are not identical in the CVEs they carry. The useful step is to install the update that belongs to the system actually running, not to assume that one headline covers every Apple device.

iOS 27.2.1 splits the Bluetooth flaws by how close an attacker would need to be

The iOS 27.2.1 security content lists several nearby-device issues. In CoreUtils, CVE-2026-113964 is described as a logic issue through which “an attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction.” CVE-2026-113965, also in CoreUtils, is narrower: “a malicious Bluetooth device may be able to establish a pairing without user interaction.” CVE-2026-113970, listed under Bluetooth, is a use-after-free through which an attacker in Bluetooth range “may be able to corrupt process memory.”

Two further entries concern AirPlay pairing codes, and they are not the same bug. CVE-2026-113968, in AirPlay, says an attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts. CVE-2026-113969, in rapportd, says an attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts. One is a nearby-radio issue; the other is a same-network issue. Neither is described as a remote, internet-wide flaw.

Those five Bluetooth and AirPlay CVEs appear across the 9 November notes, including the older iOS 18.7.12 and watchOS 26.6.1 branches. That is the set that a user still on those older releases can actually obtain. It is not a reason to treat a watch or an older iPhone as if it had received every fix in the iOS 27.2.1 list.

The iMessage flaws are a different problem, and not every release includes them

The iMessage issues sit in Messages, not in CoreUtils. CVE-2026-113961, which NVD also records, is an authorisation issue: “a remote attacker may be able to join an iMessage group chat and receive its messages.” CVE-2026-113960 is different again: “a user added to an iMessage group may be able to access messages sent before they joined.” The first is about an outsider joining a group. The second is about a member who was added later reading earlier traffic. Combining them into one “remote iMessage bug,” or into the Bluetooth list, would flatten two official impact lines that Apple kept apart.

Those two Messages CVEs are in iOS and iPadOS 27.2.1 and 26.7.3, macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3, watchOS 27.2.1 and visionOS 27.2.1. They are not in the iOS and iPadOS 18.7.12 note, and they are not in the watchOS 26.6.1 note. Anyone still on those older branches who is looking for the iMessage fixes will not find them there.

The iOS 27.2.1 note also lists two further entries that are not part of that Bluetooth or iMessage set: CVE-2026-113963 in App Intents, where an app “may be able to access sensitive user data,” and CVE-2026-111497 in brotli, where processing maliciously crafted input “may lead to memory corruption.” They are on the same 27.2.1 page. They are not in every other 9 November note either; the App Intents issue, for example, is on iOS 27.2.1, watchOS 27.2.1 and visionOS 27.2.1, and not on the macOS or iOS 26.7.3 lists.

A security update is not a zero-day advisory

The practical instruction is short: install the 9 November update that matches the device. Apple’s notes set out no click-path, and this article will not invent one. What they do say is which systems are covered and which impact lines have been fixed. For an iPhone 11 or later, that package is iOS 27.2.1. A Mac, an Apple Watch or an older iPhone needs the note that names that system, not a borrowed list from a different release.

It is also worth keeping this update distinct from the Apple stories TSN has already covered when a flaw was being exploited. In October, Apple patched an exploited CoreGraphics issue on older iPhones and iPads. This month, CISA added a 2024 Apple WebKit flaw to its KEV list. Those posts exist because a vendor or a federal catalogue said the bug was used in attacks. Nothing in the 9 November notes, or in the CVE records cited here, says that about CVE-2026-113964 or its companions. Treating them as zero-days, or as a single remote attack, would go beyond the official sources.

The same caution applies when reading Bluetooth, AirPlay and iMessage in one headline. A pairing-code issue that requires Bluetooth range is not the same as a same-network AirPlay issue, and neither is the same as a remote iMessage-group problem or a newly added member reading earlier messages. The iOS 27 platform is already in TSN’s recent coverage for other reasons, including Calif’s untethered iOS 27.0.1 jailbreak demonstration, which is a separate research story and not a claim about these CVEs.

What to watch next is not a deadline from CISA, which has not listed these identifiers, but whether Apple revises any of the 9 November notes or whether an official source later says one of the flaws is being exploited. Until that happens, the update itself is the story, and the right build is the one written for the system in hand.

Sources

1. Apple, “About the security content of iOS 27.2.1 and iPadOS 27.2.1,” 9 November 2026. https://support.apple.com/en-us/149715
2. CVE Program (Apple Inc. as CNA), CVE-2026-113964, published 9 November 2026. https://www.cve.org/CVERecord?id=CVE-2026-113964
3. NIST National Vulnerability Database, CVE-2026-113961, published 9 November 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-113961
4. Apple, matching 9 November 2026 security notes: iOS and iPadOS 26.7.3; iOS and iPadOS 18.7.12; macOS Golden Gate 27.2.1; macOS Tahoe 26.7.3; macOS Sequoia 15.8.3; watchOS 27.2.1; watchOS 26.6.1; visionOS 27.2.1.

Related stories

Apple’s October patch for an exploited CoreGraphics flaw on older iPhones and iPads is the nearest TSN contrast: that was a case Apple tied to attacks in the wild, which this 9 November update is not.

Also relevant:

• CISA Adds Apple’s 2024 WebKit Flaw CVE-2024-27834 to Its KEV List
• Calif Demos an Untethered iOS 27.0.1 Jailbreak on iPhone 18 Pro at Hexacon