EN PT-BR
← Voltar ao feed
medium

Apple iOS, iPadOS, macOS, visionOS and watchOS: ten CVEs fixed in November 2026 updates

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 21:00 · coletado há 2 horas

CERT-FR advisory CERTFR-2026-AVI-1487 covers multiple vulnerabilities in Apple operating systems, with bulletins dated 9 November 2026 (Apple security bulletins 149715 to 149724, except 149721). The advisory lists ten CVEs, from CVE-2026-111497 to CVE-2026-113971, and says they can lead to data confidentiality loss, data integrity loss or a security policy bypass. The article does not give a per-CVE severity, a CVSS score, the affected components or any exploitation status, and it refers readers to Apple's bulletins for the details. The Apple bulletin pages could not be opened during this research, so the vendor's own severity and prerequisites are not confirmed here. A separate AppleVis report on the 27.2.1 release says it includes security fixes for iOS, iPadOS, macOS and watchOS, one of them concerning macOS command line tools and compromised eMudhra certificates (applevis.com), but that report does not map to the CVE list in the advisory. Urgency is rated medium because the vendor-patched flaws have no stated exploitation or severity, yet they span every major Apple platform and should be patched promptly.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1487 covers ten CVEs, CVE-2026-111497 and CVE-2026-113960 to CVE-2026-113971 (without 113962, 113966 and 113967), in Apple operating systems. The advisory says they can cause loss of data confidentiality, loss of data integrity or a security policy bypass. It gives no per-CVE severity, CVSS score, component, attack vector, prerequisites or exploitation status, and the Apple bulletins could not be opened. Affected: iOS and iPadOS before 18.7.12, 26.7.3 and 27.2.1; macOS Sequoia before 15.8.3, Tahoe before 26.7.3 and Golden Gate before 27.2.1; visionOS before 27.2.1; watchOS before 26.6.1 and 27.2.1. Fixed in those versions.

Como foi descoberta

CERT-FR only says that multiple vulnerabilities were discovered in Apple products and points to Apple's security bulletins 149715 to 149724 (except 149721), all dated 9 November 2026. The articles do not say who found the flaws or how they were reported. A separate AppleVis report on the 27.2.1 release mentions a security fix about macOS command line tools and compromised eMudhra certificates, but it does not map to the CVE list in the advisory.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:39.

Detalhes técnicos

The advisory names three impact categories: data integrity, data confidentiality and security policy bypass. It lists affected branches: iOS and iPadOS before 18.7.12, 26.7.3 and 27.2.1; macOS Golden Gate before 27.2.1, macOS Sequoia before 15.8.3 and macOS Tahoe before 26.7.3; visionOS before 27.2.1; and watchOS before 26.6.1 and 27.2.1. The article does not state the attack vector, prerequisites or user interaction for any CVE.

Remediação

Apply the Apple updates for each platform and branch listed above, using the fixed versions the advisory gives: iOS and iPadOS 18.7.12, 26.7.3 or 27.2.1; macOS Sequoia 15.8.3; macOS Tahoe 26.7.3; macOS Golden Gate, visionOS and watchOS 27.2.1; watchOS 26.6.1 for the 26 branch. The advisory directs administrators to Apple's bulletins for the patches (cert.cyber.gouv.fr).

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 09/11/2026 21:00 · coletado 10/11 13:04 primeiro registro

    Apple iOS, iPadOS, macOS, visionOS and watchOS: ten CVEs fixed in November 2026 updates

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1487 covers multiple vulnerabilities in Apple operating systems, with bulletins dated 9 November 2026 (Apple security bulletins 149715 to 149724, except 149721). The advisory lists ten CVEs, from CVE-2026-111497 to CVE-2026-113971, and says they can lead to data confidentiality loss, data integrity loss or a security policy bypass. The article does not give a per-CVE severity, a CVSS score, the affected components or any exploitation status, and it refers readers to Apple's bulletins for the details. The Apple bulletin pages could not be opened during this research, so the vendor's own severity and prerequisites are not confirmed here. A separate AppleVis report on the 27.2.1 release says it includes security fixes for iOS, iPadOS, macOS and watchOS, one of them concerning macOS command line tools and compromised eMudhra certificates (applevis.com), but that report does not map to the CVE list in the advisory. Urgency is rated medium because the vendor-patched flaws have no stated exploitation or severity, yet they span every major Apple platform and should be patched promptly.

    Technical Details

    The advisory names three impact categories: data integrity, data confidentiality and security policy bypass. It lists affected branches: iOS and iPadOS before 18.7.12, 26.7.3 and 27.2.1; macOS Golden Gate before 27.2.1, macOS Sequoia before 15.8.3 and macOS Tahoe before 26.7.3; visionOS before 27.2.1; and watchOS before 26.6.1 and 27.2.1. The article does not state the attack vector, prerequisites or user interaction for any CVE.

    Remediation

    Apply the Apple updates for each platform and branch listed above, using the fixed versions the advisory gives: iOS and iPadOS 18.7.12, 26.7.3 or 27.2.1; macOS Sequoia 15.8.3; macOS Tahoe 26.7.3; macOS Golden Gate, visionOS and watchOS 27.2.1; watchOS 26.6.1 for the 26 branch. The advisory directs administrators to Apple's bulletins for the patches (cert.cyber.gouv.fr).