iOS/iPadOS updates fix 10 flaws that could let attackers in Bluetooth range pair without interaction or join iMessage groups uninvited

Apple released iOS and iPadOS 27.2.1 and 18.7.12 security updates on November 9, 2026, fixing flaws that could let an attacker in Bluetooth range bypass the pairing-code attempt limit and pair without user interaction, or let a remote attacker join an iMessage group chat and receive its messages ^[1][2]. iThome counts 10 unique flaws across the two bulletins; the Brotli out-of-bounds write CVE-2026-111497 fixed in 27.2.1 was added to the CISA Known Exploited Vulnerabilities catalog on October 27, though there is no evidence attackers have used it against iPhone or iPad ^[3]. iPhone 11 and later and supported iPads should update to 27.2.1, while iPhone XS, XS Max, XR and iPad 7th generation should update to 18.7.12 ^[1][2].

Organisations running: Apple iOS / iPadOS

iPhone 11 and later and supported iPads should update to 27.2.1, while iPhone XS, XS Max, XR and iPad 7th generation should update to 18.7.12 ^[1]