Apple has released iOS 27.2.1 and iPadOS 27.2.1 with fixes for nine security vulnerabilities, including two in Messages that could expose iMessage group chats and several in Bluetooth pairing.
The update is available for iPhone 11 and later and a wide range of iPads, and Apple’s security notes list it as released on 9 November 2026. Apple shipped matching updates the same day for older software lines (iOS 26.7.3 and iOS 18.7.12), macOS, watchOS and visionOS.
Messages and iMessage groups
Two fixes concern Messages. In one, Apple says a remote attacker may have been able to join an iMessage group chat and receive its messages (CVE-2026-113961), which it fixed with improved validation. In the other, a user added to a group may have been able to read messages sent before they joined (CVE-2026-113960); Apple removed the vulnerable code. Both were reported by an anonymous researcher.
Bluetooth and AirPlay pairing
Five entries cover pairing. Apple fixed a rate-limit bypass on pairing code attempts in AirPlay, CoreUtils and rapportd, which could let an attacker in Bluetooth range or on the same network keep guessing codes. One CoreUtils fix (CVE-2026-113965) addresses a malicious Bluetooth device that could establish a pairing without user interaction. A separate Bluetooth use-after-free (CVE-2026-113970) could let a nearby attacker corrupt process memory.
Other fixes
App Intents had an authorisation issue that let an app access sensitive user data (CVE-2026-113963, credited to László Várady). A brotli out-of-bounds write could cause memory corruption when processing maliciously crafted input (CVE-2026-111497).
What to do
Install it from Settings > General > Software Update. Apple doesn’t say any of the issues were exploited in the wild, and it keeps older iPhones covered with iOS 26.7.3 and, for iPhone XS, XS Max and XR, iOS 18.7.12.