Apple has released watchOS 26.6.1 with fixes for five security vulnerabilities, including flaws that could let a nearby attacker pair with a watch without the owner's involvement. Released November 9, the update addresses problems involving Bluetooth, AirPlay, CoreUtils and rapportd, with potential effects ranging from unwanted pairing to corruption of memory used by a process.
The fixes cover Apple Watch Ultra and Apple Watch SE (2nd generation), alongside Apple Watch Series 8, Apple Watch Series 6 and Apple Watch Series 7. Four of the five vulnerabilities involve either an attacker within Bluetooth range or a malicious Bluetooth device; the fifth involves an attacker sharing the target's network.
Read more: Apple Watch Series Models Will Get Modular Ultra Watch Face in watchOS 27
One CoreUtils vulnerability, CVE-2026-113964, could allow an attacker within Bluetooth range to evade limits on pairing code guesses and pair without requiring the user to act, according to Apple. Apple credits an anonymous researcher with that discovery and says it corrected the underlying logic problem by changing how state is managed. A separate CoreUtils flaw, CVE-2026-113965, could let a hostile Bluetooth device complete pairing without the user's involvement; Apple says it added checks to address it.
The AirPlay fix addresses CVE-2026-113968, which Apple says could let someone within Bluetooth range get around restrictions on repeated pairing code guesses. The rapportd vulnerability, CVE-2026-113969, concerns a similar limit on AirPlay code guesses, but its stated attack condition is access to the same network. Apple says changes to state management resolved both logic flaws.
The Bluetooth vulnerability, CVE-2026-113970, could allow a nearby attacker to corrupt memory belonging to a process, according to Apple. Apple identifies the cause as a use-after-free error and says it changed memory management to fix it. The company credits its own researchers for this vulnerability and the AirPlay, rapportd and remaining CoreUtils discoveries.
Apple also released iOS 27.2.1 and iPadOS 27.2.1 on November 9 for supported devices, including iPhone 11 and later. Earlier, Apple released watchOS 27 public beta 4 on August 26, carrying build 24R5353a. That beta round brought fixes for bugs and improvements to performance as Apple approached the operating systems' planned public releases.
