# Apple Bluetooth/AirPlay Pairing Vulnerabilities Patched Across Apple Platforms (CVE-2026-113968, CVE-2026-113969, CVE-2026-113964, CVE-2026-113965, CVE-2026-113970)

> On 2026-11-09 Apple patched 10 vulnerabilities across iOS, iPadOS, macOS, watchOS and visionOS, five of them in AirPlay, rapportd, CoreUtils and Bluetooth that allow pairing-code rate-limit bypass, pairing without user interaction, and a Bluetooth use-after-free. The release also fixes iMessage group-chat exposure bugs, an App Intents authorization flaw, a lock-screen AirPlay pairing issue and the Brotli out-of-bounds write CVE-2026-111497 (Node2Shell), which is in CISA KEV and exploited against non-Apple targets.

- **Published:** 2026-11-11T07:21:33Z
- **Last reviewed:** 2026-11-11T07:21:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5738
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5738.png
- **ID:** TL-2026-5738
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-113968, CVE-2026-113969, CVE-2026-113964, CVE-2026-113965, CVE-2026-113970, CVE-2026-113961, CVE-2026-113960, CVE-2026-111497, CVE-2026-113963, CVE-2026-113971

## Description

Apple released iOS/iPadOS 27.2.1, 26.7.3 and 18.7.12, macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3, watchOS 27.2.1 and 26.6.1, and visionOS 27.2.1 on 2026-11-09 (advisories HT149715, 149716, 149718). Per SecurityWeek and the Apple advisory, five flaws concern pairing: CVE-2026-113968 (AirPlay) lets a nearby Bluetooth attacker bypass pairing-code attempt limits (fixed with better state handling); CVE-2026-113969 (rapportd) lets a network-adjacent attacker bypass AirPlay pairing-code attempt limits; CVE-2026-113964 (CoreUtils) lets a nearby Bluetooth attacker bypass the pairing-code rate limit and pair without user interaction; CVE-2026-113965 (CoreUtils) lets a malicious Bluetooth device pair without user interaction (fixed with additional checks); and CVE-2026-113970 (Bluetooth) is a use-after-free that lets a nearby Bluetooth attacker corrupt process memory.

Other fixes: CVE-2026-113961 and CVE-2026-113960 (Messages) allowed a remote attacker to join an iMessage group chat and receive its messages, and let users added to a group read earlier messages; CVE-2026-113963 (App Intents) is an authorization state-handling flaw that could let an app access sensitive user data (credited to Laszlo Varady; iOS/iPadOS, watchOS and visionOS 27.2.1); CVE-2026-113971 (AirPlay lock screen) allowed an attacker with physical access to pair a device with an AirPlay receiver from the lock screen (iOS/iPadOS 18.7.12 only; iPhone XS, XS Max, XR and 7th-gen iPad). Apple credits itself for five issues; an anonymous researcher is credited for CVE-2026-113964 and both Messages bugs.

CVE-2026-111497 (Brotli, 'Node2Shell', also HTTP2Shell/Broccoli2Shell) is an out-of-bounds write in Google's Brotli decoder (CWE-787, with unchecked return value CWE-252): a crafted stream drives the streaming decoder into an invalid block-switch state that reports 'need more input' instead of a format error, so decoding continues past an eight-byte internal buffer. Apple's advisory describes it as crafted input causing memory corruption. Brotli 1.0.3 through 1.2.0 are affected (fixed in 1.0.10, 1.1.1, 1.2.1). CISA added it to KEV on 2026-10-27 (federal deadline 2026-11-10). ELLIO and Previdian honeypots recorded exploitation attempts against Node.js 24.22.0; ELLIO found the attacker's final stage produced no shell in 50 tests, while public PoC delivery code exists and failed attempts can crash the target process. Sources report no indication of attacks against Apple products.

None of Apple's advisories mention exploitation in the wild for the Apple-specific flaws; no CVSS scores, PoC or attribution are published for them. The practical risk is proximity-based: an attacker within Bluetooth range or on the same network could pair with a device without user interaction. Severity MEDIUM is the analyst's assessment, not source-stated. Note: per-CVE details for Apple flaws are limited to the SecurityWeek article and the HT149715 advisory; the 26.x/18.x/watchOS/macOS advisories were not independently parsed.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1110 Brute Force
- T1005 Data from Local System
- T1595.002 Vulnerability Scanning

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Node.js/Bun Runtime Segfault Consistent with Brotli Decoder Exploitation (CVE-2026-111497 Node2Shell)** (`TL-2026-5738-SPL-001`)

Detects a Node.js or Bun process terminating with SIGSEGV (signal 11, exit code 139) on Linux hosts. Failed Node2Shell (CVE-2026-111497, Brotli out-of-bounds write, CWE-787) exploitation attempts crash the target process; ELLIO honeypots observed attempts against Node.js 24.22.0. CVE-2026-111497 is in CISA KEV. A crash is also a signal of probing that did not yet yield code execution.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1203
- **Data sources:** linux_audit (auditd ANOM_ABEND), linux syslog kernel segfault
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype=linux_audit type=ANOM_ABEND sig=11 (comm=node OR comm=bun OR exe="*/node" OR exe="*/bun") earliest=-24h | eval cve="CVE-2026-111497", campaign="Node2Shell" | stats count AS crashes min(_time) AS first_seen max(_time) AS last_seen values(exe) AS exe values(cve) AS cve by host comm | convert ctime(first_seen) ctime(last_seen) | sort - crashes
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName =~ "kernel"
| where SyslogMessage has "segfault"
| where SyslogMessage matches regex @"\b(node|bun)\[\d+\]"
| extend CVE = "CVE-2026-111497", Campaign = "Node2Shell"
| summarize Crashes = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, CVE, Campaign
| order by Crashes desc
```

### Sigma

```yaml
title: Node.js/Bun Runtime Segfault Consistent with Brotli Decoder Exploitation (CVE-2026-111497 Node2Shell)
id: 3b7e1c52-8a14-4d6f-9e21-5738a0000001
status: experimental
description: Detects a Node.js or Bun process aborting with SIGSEGV, consistent with failed Brotli decoder out-of-bounds write exploitation (CVE-2026-111497, Node2Shell)
references:
    - https://support.apple.com/en-us/149715
    - https://www.securityweek.com/bluetooth-airplay-pairing-vulnerabilities-patched-across-apple-platforms/
    - https://www.securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts/
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1203
    - cve.2026.111497
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'ANOM_ABEND'
        sig: '11'
        comm:
            - 'node'
            - 'bun'
    condition: selection
falsepositives:
    - Native add-on bugs or memory faults in legitimate Node.js applications
    - Out-of-memory or developer debugging crashes on build servers
level: medium

```

**Known false positives:**

- Native add-on bugs or memory faults in legitimate Node.js applications
- Out-of-memory or developer debugging crashes on build servers

**Tuning notes:** Requires auditd ANOM_ABEND events (index=linux sourcetype=linux_audit); adjust index to your environment. Restrict to internet-facing Node.js/Bun hosts, correlate with inbound requests carrying Content-Encoding: br, and suppress known-buggy internal apps. Alert on any crash for hosts running Node.js prior to 22.23.4, 24.22.1 or 26.12.1.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Bluetooth Pairing Completed Without User Interaction Evidence (CVE-2026-113964, CVE-2026-113965) (locked: unlock with TL Creds)
- Apple Pairing Daemon Crash Burst Consistent with Bluetooth Use-After-Free (CVE-2026-113970) (locked: unlock with TL Creds)
- Containerized Node.js/Bun Crash Loop with Exit Code 139 (CVE-2026-111497 Brotli Decoder) (locked: unlock with TL Creds)
- Node.js or Bun Process Spawning a Shell (Post-Exploitation after CVE-2026-111497) (locked: unlock with TL Creds)
- Node.js or Bun Reading Sensitive Credential Files (Post-Exploitation Collection after CVE-2026-111497) (locked: unlock with TL Creds)
- Brotli-Encoded Chunked HTTP Request Body Consistent with Node2Shell Delivery (CVE-2026-111497) (locked: unlock with TL Creds)
- Apple Bluetooth/AirPlay Pairing-Code Attempt Burst (CVE-2026-113964, CVE-2026-113968, CVE-2026-113969) (locked: unlock with TL Creds)
- AirPlay Pair-Setup/Pair-Verify Flood or Sweep from a Single Network Host (CVE-2026-113969) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [SecurityWeek: Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms](https://www.securityweek.com/bluetooth-airplay-pairing-vulnerabilities-patched-across-apple-platforms/)
- [Apple security releases index](https://support.apple.com/en-us/100100)
- [Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1](https://support.apple.com/en-us/149715)
- [Apple: About the security content of iOS 26.7.3 and iPadOS 26.7.3](https://support.apple.com/en-us/149716)
- [Apple: About the security content of macOS Golden Gate 27.2.1](https://support.apple.com/en-us/149718)
- [SecurityWeek: CISA warns of Node2Shell exploitation as honeypots log attack attempts](https://www.securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts/)
- [BleepingComputer: CISA warns of hackers now exploiting critical Node2Shell flaw](https://bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw)
- [SAFE Security: CVE-2026-111497 Inside Node2Shell and the Brotli Decoder Flaw](https://safe.security/resources/blog/cve-2026-111497-inside-node2shell-and-the-brotli-decoder-flaw/)
- [SonicWall: Node2Shell Node.js Brotli Decoder Out-of-Bounds Write RCE](https://www.sonicwall.com/blog/node2shell-node-js-brotli-decoder-out-of-bounds-write-remote-code-execution)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5738