This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction.

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.7.3. It is, therefore, affected by multiple vulnerabilities:

  - A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3     through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state     memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary     code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries     between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. (CVE-2026-111497)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS     26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3,     visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent     before they joined. (CVE-2026-113960)

  - An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and     iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe     26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and     receive its messages. (CVE-2026-113961)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS     18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS     Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in     Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device     without user interaction. (CVE-2026-113964)

  - This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS     26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3,     macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be     able to establish a pairing without user interaction. (CVE-2026-113965)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 18.7.12. It is, therefore, affected by multiple vulnerabilities.

The remote host is running a version of macOS / Mac OS X that is 27.x prior to 27.2.1. It is, therefore, affected by multiple vulnerabilities:

  - A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3     through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state     memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary     code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries     between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. (CVE-2026-111497)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS     26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3,     visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent     before they joined. (CVE-2026-113960)

  - An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and     iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe     26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and     receive its messages. (CVE-2026-113961)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS     18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS     Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in     Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device     without user interaction. (CVE-2026-113964)

  - This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS     26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3,     macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be     able to establish a pairing without user interaction. (CVE-2026-113965)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.8.3. It is, therefore, affected by multiple vulnerabilities:

  - A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3     through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state     memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary     code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries     between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. (CVE-2026-111497)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS     26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3,     visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent     before they joined. (CVE-2026-113960)

  - An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and     iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe     26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and     receive its messages. (CVE-2026-113961)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS     18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS     Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in     Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device     without user interaction. (CVE-2026-113964)

  - This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS     26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3,     macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be     able to establish a pairing without user interaction. (CVE-2026-113965)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 27.2.1. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 26.7.3. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Type	Severity
377984	macOS 26.x < 26.7.3 Multiple Vulnerabilities (149719)	Nessus	MacOS X Local Security Checks	Local	critical
377981	Apple iOS < 18.7.12 Multiple Vulnerabilities (149717)	Nessus	Mobile Devices	Local	high
377980	macOS 27.x < 27.2.1 Multiple Vulnerabilities (149718)	Nessus	MacOS X Local Security Checks	Local	critical
377979	macOS 15.x < 15.8.3 Multiple Vulnerabilities (149720)	Nessus	MacOS X Local Security Checks	Local	critical
377978	Apple iOS < 27.2.1 Multiple Vulnerabilities (149715)	Nessus	Mobile Devices	Local	critical
377977	Apple iOS < 26.7.3 Multiple Vulnerabilities (149716)	Nessus	Mobile Devices	Local	critical

Detections

Analytics

CVE-2026-113965

medium

Tenable Plugins

critical

high

critical

critical

critical

critical