Apple shipped iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026, patching nine security flaws across eight parts of the operating system. The fixes cover a Bluetooth pairing bypass, an AirPlay rate-limit bypass, a memory corruption bug in the bundled brotli library, and two issues in Messages that affected who can see what in an iMessage group chat. The update applies to iPhone 11 and later, plus iPad Pro (4th generation and later), iPad Air (4th generation and later), the 9th-generation iPad, and iPad mini (6th generation and later), according to Apple’s own security advisory.
What iOS 27.2.1 fixes in iMessage
Two of the nine CVEs sit in Messages. CVE-2026-113961 let a remote attacker join an iMessage group chat and start receiving its messages, an authorization gap that Apple closed with improved validation. CVE-2026-113960 went the other direction: someone added to a group chat could see messages sent before they joined, which Apple fixed by removing the vulnerable code outright rather than patching around it. Neither bug needed physical access to a device, which sets this pair apart from most of the rest of the list.
Bluetooth and AirPlay pairing bypasses
The remaining fixes are mostly about proximity. CVE-2026-113968 and CVE-2026-113964 both let an attacker within Bluetooth range get around the rate limit on pairing code attempts, essentially brute-forcing a pairing PIN without Apple’s throttling kicking in. CVE-2026-113965 is adjacent to that: a malicious Bluetooth device could pair with an iPhone or iPad without any user interaction at all. CVE-2026-113970 is a use-after-free in the Bluetooth stack that an attacker in range could use to corrupt process memory, and CVE-2026-113969 extends the same rate-limit bypass idea to AirPlay pairing codes over a shared network.
The ninth fix, CVE-2026-111497, is a memory corruption bug in brotli, the compression library Apple bundles system-wide, triggered by processing a maliciously crafted input.
What to do about it
None of the nine are flagged by Apple as actively exploited, so there’s no need to panic-patch overnight. But the Bluetooth and AirPlay issues are the kind that matter most in places with a lot of unlocked devices nearby, conferences, coworking spaces, retail floors, anywhere a stranger could sit in range long enough to try a pairing handshake. If your team manages a fleet of company iPhones or iPads, or you build apps that lean on Bluetooth or AirPlay pairing flows as part of a mobile app, push the update and retest those pairing paths rather than assuming nothing changed. Apple’s last iOS security release landed in late September, for a different CoreGraphics zero-day, so this is a fresh set of issues, not a re-release of that one.
