Vulnerability

CVE-2026-113971

3.5CVSS base score · low (NVD)

0.2%Chance of exploitation in the next 30 days (FIRST EPSS)

Not in KEVNo confirmed exploitation in CISA's catalog yet

What is it?

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen.

Official description from NVD.

What happened

Apple released updates fixing nine vulnerabilities across iOS 26, 27, iPadOS, macOS, watchOS, and visionOS. CVE-2026-113960 and CVE-2026-113961 enable message access in iMessage group chats. CVE-2026-113963 allows app access to sensitive user data. CVE-2026-113964 bypasses Bluetooth pairing code rate limits. Apply updates to patch privacy and authentication flaws.

From the Intel60 brief of Nov 10, 2026. AI-written summary: check the sources before acting.

Intel60 briefs

HighApple patches nine vulnerabilities across iOS, macOS, watchOSNov 10, 2026

Official records

NVDScores, affected versions and references
CVE.orgThe official CVE record