CVE-2026-113961

CVE-2026-113961 is an authorization vulnerability affecting Apple's iMessage service. The flaw allows a remote attacker to join an active iMessage group chat without authorization and subsequently receive messages sent within that group. Discovered by an anonymous researcher, the issue stems from a validation weakness in how group chat access is authorized. Apple addressed this vulnerability in security updates released on November 9, 2026, by implementing improved validation mechanisms. The fix is included in several operating system updates, including iOS 27.2.1, iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, and watchOS 27.2.1. At the time of the release, Apple's advisory did not confirm whether the vulnerability had been actively exploited in real-world attacks.