Apple has patched two iMessage privacy flaws that could expose group conversations to an unauthorized participant or reveal older messages to someone newly added, according to Bitdefender. Fixes arrived November 9 in updates for iPhone, iPad and Mac, addressing both entry into a conversation and access to its earlier exchanges.
For iPhone users, the patches are in iOS 27.2.1 and iOS 26.7.3; iPad users receive them through iPadOS 27.2.1 and iPadOS 26.7.3. Mac versions containing both fixes include macOS Sequoia 15.8.3, macOS Golden Gate 27.2.1 and macOS Tahoe 26.7.3. The latest releases support iPhone 11 and newer models, with iPad support varying by operating system version.
Read more: Apple releases macOS Tahoe 26.3 with security patches and bug fixes
The group membership vulnerability, CVE-2026-113961, could let a remote attacker enter an iMessage conversation and receive messages without authorization. Apple strengthened the checks governing permission to join to address that weakness. An anonymous security researcher reported this vulnerability and the separate flaw affecting access to older messages.
That second issue, CVE-2026-113960, could allow a legitimately added participant to retrieve messages exchanged before their arrival. Apple removed the code responsible for the problem, taking a different approach from the authorization changes used for the group membership flaw. Apple has made no public report of either vulnerability being actively exploited.
Apple also issued November 9 security updates for devices on iOS 18, Apple Watch and Vision Pro, although the vulnerabilities addressed differ between releases. The Messages fixes accompanied patches involving AirPlay, Bluetooth and other parts of Apple's operating systems. The watchOS 26.6.1 release addressed five vulnerabilities, including weaknesses that could permit pairing without action by the watch's owner.
Four of those watchOS vulnerabilities required either Bluetooth proximity or a malicious Bluetooth device, while the fifth required access to the target's network. To install the messaging fixes on an iPhone or iPad, users can open Settings, select General and then Software Update. On a Mac, the update control is under General in System Settings; Bitdefender also recommends checking who belongs to sensitive iMessage groups, especially after adding someone.
