iOS 27.2.1 Security Update: iMessage Flaw CVE-2026-113961 Could Let Outsiders Join Group Chats, and the Versions to Install

Apple released iOS 27.2.1 and iPadOS 27.2.1 on Monday, November 9, 2026. The update fixes a flaw in Messages that could let a remote attacker join an iMessage group chat and receive its messages. If your staff use iMessage groups on company iPhones, iPads or Macs to talk about jobs, clients or pricing, those conversations are what this update protects.

Apple shipped the same Messages fixes for Macs, newer Apple Watches and Vision Pro on the same day. Some older devices got an update that day that does not list the fix. The details are below.

What Apple fixed in iOS 27.2.1

Apple's security notes for iOS 27.2.1 and iPadOS 27.2.1 list nine fixes. The two that matter most for a business are in Messages:

• CVE-2026-113961: Apple says a remote attacker may be able to join an iMessage group chat and receive its messages. Apple calls it an authorization issue, fixed with improved validation.
• CVE-2026-113960: Apple says a person added to an iMessage group may be able to see messages sent before they joined. Apple fixed it by removing the vulnerable code.

Apple credits an anonymous researcher for both.

The same update also fixes:

• Bluetooth (CVE-2026-113970): a use-after-free bug that lets an attacker within Bluetooth range corrupt process memory.
• CoreUtils (CVE-2026-113965 and CVE-2026-113964): two flaws that could let a nearby Bluetooth device pair without the user doing anything.
• AirPlay (CVE-2026-113968) and rapportd (CVE-2026-113969): ways to get around the limit on how many times someone can guess a pairing code, one over Bluetooth and one over the same network.
• App Intents (CVE-2026-113963): an app may be able to access sensitive user data.
• brotli (CVE-2026-111497): crafted input could corrupt memory.

What is confirmed and what is not

Confirmed by Apple's own security notes:

• Both Messages fixes are in iOS and iPadOS 27.2.1, iOS and iPadOS 26.7.3, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1 and visionOS 27.2.1. We opened each of those notes and found both CVEs listed.
• iOS and iPadOS 18.7.12 (iPhone XS, XS Max, XR and iPad 7th generation) and watchOS 26.6.1 (Apple Watch Series 6, 7, 8, SE 2nd generation and Ultra) also came out on November 9. Their notes cover the Bluetooth and pairing fixes but have no Messages section at all.

Confirmed by CISA: the brotli flaw, CVE-2026-111497, is in CISA's Known Exploited Vulnerabilities catalog. It was added on October 27, 2026 with a federal due date of November 10, 2026. That listing covers Google's Brotli library in general. Apple does not say anyone attacked its devices through it.

Not known:

• How the group chat attack works. Apple has published no technical details. It does not say what an attacker needs to get in, or whether the other members would see an extra person join.
• Whether anyone has used it. Apple's notes do not say either Messages flaw was exploited. As of November 10, neither Messages CVE appears in CISA's Known Exploited Vulnerabilities catalog. That can change.
• Whether older devices are exposed. Apple does not say whether iOS 18 or watchOS 26.6 are affected by the Messages flaws. We only know their November 9 updates do not list a fix.

Which version to install this week

If you read our post on the iOS 27.2 security update, this is a separate release. A phone still on 27.2 does not have these fixes.

How to check and update your devices

1. iPhone and iPad: open Settings, then General, then Software Update. Afterwards, check Settings, then General, then About, and make sure the version shows 27.2.1, 26.7.3 or 18.7.12.
2. Mac: open the Apple menu, then System Settings, then General, then Software Update.
3. Apple Watch: open the Watch app on the paired iPhone, then General, then Software Update.
4. Managed devices: if you use mobile device management, filter your inventory for anything below the fixed versions in the table and set an update deadline.
5. Phones staff bring from home: ask people who read work group chats on their own devices to update, and confirm the version with them.
6. iPhone XS, XR and iPad 7th generation: install 18.7.12 for the Bluetooth fixes. Keep sensitive work group chats off these devices until Apple says more, and start planning to replace them.
7. Group chat members: in Messages, tap the group name at the top of a work group to see who is in it. Remove anyone you do not recognise.
8. Automatic updates: turn them on so the next fix installs without someone having to remember.

Apple lists no workaround. Updating is the fix.

Why this matters for a company network

A lot of business gets done in group texts: crews sorting out job sites, sales teams passing leads around, owners approving quotes. Those threads often hold customer names, addresses, door codes and prices. A flaw that lets an outsider receive group messages exposes all of that. And you would not see it happen. The messages travel through Apple's service, not through your firewall, so your own network logs would show nothing.

The second flaw matters when people come and go. When you add a new hire or a contractor to a team group, Apple says they may have been able to see messages from before they joined. Until every member's device is updated, assume a new member can read the older history.

The Bluetooth and pairing flaws need the attacker to be close by. That makes them more relevant in shared office buildings, busy job sites and public places than in a locked private office.

You can only see whether these updates are installed if you know which devices your staff actually use for work. Keeping that list is part of security hardening.

iOS 27.2.1 questions people are asking

Can someone read my iMessage group chat without being added?

Before this update, Apple says a remote attacker may have been able to join an iMessage group chat and receive its messages. Apple has not said how. Installing iOS 27.2.1, iOS 26.7.3 or the matching Mac, Watch or Vision Pro update closes it.

What is CVE-2026-113961?

It is the ID for the iMessage group chat authorization flaw Apple fixed on November 9, 2026. CVE-2026-113960 is the related flaw that let a newly added member see earlier messages.

Is the iMessage vulnerability being exploited?

Apple's notes do not say so. As of November 10, 2026, neither Messages CVE appears in CISA's Known Exploited Vulnerabilities catalog.

Does the iMessage bug affect Macs and Apple Watch?

Yes. The Messages fixes are in macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3, watchOS 27.2.1 and visionOS 27.2.1.

My iPhone XR cannot get iOS 27.2.1. Is it safe?

Its update, iOS 18.7.12, does not list the Messages fixes, and Apple has not said whether iOS 18 is affected. Install 18.7.12, keep sensitive group chats off that phone, and plan to replace it.

Is iOS 27.2.1 the same as iOS 27.2?

No. iOS 27.2 came out on October 26, 2026. iOS 27.2.1 is the November 9 follow-up that adds these fixes.

Does this affect regular SMS group texts?

Apple's notes talk only about iMessage group chats. They do not mention SMS.

The bigger lesson

An update that only moves the version number by a decimal point can still close a flaw that exposes your conversations. The businesses that get through these releases quickly have three things: a list of their devices, automatic updates turned on, and someone who checks that the updates actually installed. Those are the same steps whether the bug is in a firewall or in a group chat.

If you want help tightening your devices and systems, see security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: Apple: iOS 27.2.1 and iPadOS 27.2.1 security content; Apple: iOS 26.7.3 and iPadOS 26.7.3; Apple: iOS 18.7.12 and iPadOS 18.7.12; Apple: macOS Golden Gate 27.2.1; Apple: macOS Tahoe 26.7.3; Apple: macOS Sequoia 15.8.3; Apple: watchOS 27.2.1; Apple: watchOS 26.6.1; Apple: visionOS 27.2.1; Apple security releases; CISA Known Exploited Vulnerabilities Catalog.