Apple's security document for iOS 27.2.1 and iPadOS 27.2.1 (released 9 November 2026, for iPhone 11 and later and supported iPads) lists nine fixes.

Apple says an attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts (CVE-2026-113968, AirPlay) and pair with a device without user interaction (CVE-2026-113964, CoreUtils); a malicious Bluetooth device may be able to establish a pairing without user interaction (CVE-2026-113965, CoreUtils); an attacker in Bluetooth range may be able to corrupt process memory (CVE-2026-113970, Bluetooth use-after-free); an attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts (CVE-2026-113969, rapportd); a remote attacker may be able to join an iMessage group chat and receive its messages (CVE-2026-113961, Messages); a user added to an iMessage group may be able to access messages sent before they joined (CVE-2026-113960); an app may be able to access sensitive user data (CVE-2026-113963, App Intents); and processing maliciously crafted input may lead to memory corruption (CVE-2026-111497, brotli). The document does not say any of the flaws has been exploited (source: Apple).

Apple's security releases page also lists iOS and iPadOS 26.7.3 and 18.7.12, macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, macOS Sequoia 15.8.3 and watchOS 27.2.1, all dated 9 November 2026 (source: Apple security releases).