Apple iMessage Vulnerabilities Expose Private Group Chats to Unauthorised Access

Threat Category: Privacy Exposure | Access Control | Mobile Security
Affected Platforms: Apple iOS, iPadOS, macOS, watchOS and visionOS
Key Vulnerabilities: CVE-2026-113961, CVE-2026-113960

When Private Conversations Are No Longer Private

Group chats often contain more than casual conversations. For organisations, they can be used to coordinate projects, share operational updates and exchange sensitive business information. Two newly disclosed vulnerabilities in Apple's iMessage service raise concerns about who can access these conversations.

Apple has released security updates addressing CVE-2026-113961 and CVE-2026-113960, which could allow unauthorised access to iMessage group conversations.

The first vulnerability, CVE-2026-113961, is an authorisation flaw that could allow a remote attacker to join an iMessage group and receive its messages without being invited. The second, CVE-2026-113960, could allow a user added to a group to access messages sent before they joined. Apple addressed the issues through improved authorisation validation and removal of the vulnerable code, respectively.

Apple has not confirmed whether either vulnerability has been exploited in the wild or disclosed the specific conditions required to carry out an attack.

Beyond iMessage: Bluetooth and AirPlay Security Risks

The updates address additional vulnerabilities affecting Bluetooth and AirPlay, Apple's wireless communication and media-streaming technologies.

Some of these flaws could allow a malicious Bluetooth device to establish a pairing without user interaction, while others could enable attackers within Bluetooth range to bypass pairing-code attempt limits. A separate AirPlay flaw could allow an attacker on the same network to bypass pairing-code restrictions.

Apple also addressed CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli compression library that could result in memory corruption when processing maliciously crafted input.

Together, these issues highlight risks across messaging, wireless connectivity and data processing on Apple devices. For organisations using Apple devices for business communications, unauthorised access to group conversations could expose internal discussions, operational information and potentially sensitive customer-related details.

What Organisations Should Do

Organisations should prioritise Apple's latest security updates across supported devices, particularly those used to access corporate communications and business information.

• Apply security updates: Install the latest compatible releases, including iOS/iPadOS 27.2.1 or 26.7.3 and the corresponding macOS security updates. Check Apple's security release notes for the correct version for each device.

• Verify device coverage: Maintain an inventory of corporate-managed Apple devices and confirm that updates have been successfully installed. Apple has not clarified whether every older device or software version is affected by the iMessage flaws.

• Review wireless security: Restrict Bluetooth and AirPlay functionality where they are not required, particularly in sensitive environments, and avoid accepting unexpected pairing requests.

• Assess information exposure: Review the sensitivity of information shared through group messaging and use approved corporate communication platforms for confidential business discussions.

• Monitor and investigate: Track Apple security advisories and investigate suspicious device activity, unexpected pairing events and unusual access to corporate accounts.

As Apple devices increasingly support everyday business operations, their security should remain part of organisational vulnerability management. Threat intelligence monitoring can help identify emerging risks affecting these platforms, while security operations teams can investigate suspicious device and account activity. Regular security assessments can also help determine whether device-management and access controls are being consistently enforced.

The concern is not limited to who can enter a group chat. It is also about what information becomes accessible once they do. Prompt updates and effective device controls remain essential to protecting business communications.

‍