[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fp3RQzfQdN6s5mBq6PlETGDhwlYp0WRfJMA8UoVGZzn0":3},{"article":4,"iocs":39,"watch_terms":68,"solutions":69,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c56b0d6e-30aa-4745-874d-913be9612013","Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","apple-patches-everyting-november-2026-edition-tue-nov-10th-f5abc9","
","Apple has released updates for its operating systems including iOS, iPadOS, macOS, watchOS, and visionOS, addressing a total of nine vulnerabilities. One specific vulnerability, CVE-2026-113971, affects only iOS\u002FiPadOS version 26. Several of the patched issues relate to Bluetooth, potentially weakening device pairing security.","Apple releases updates for iOS, macOS, watchOS, and visionOS fixing nine vulnerabilities.","https:\u002F\u002Fisc.sans.edu\u002Fdiary\u002Frss\u002F33506","https:\u002F\u002Fisc.sans.edu\u002Fimages\u002Flogos\u002Fisc\u002Flarge.png","2026-11-10T12:48:55+00:00","2026-11-10T13:00:35.533771+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"Apple","vendor",{"name":21,"type":22},"iOS","product",{"name":24,"type":22},"iPadOS",{"name":26,"type":22},"macOS",{"name":28,"type":22},"watchOS",{"name":30,"type":22},"visionOS","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},[40,44,47,50,53,56,59,62,65],{"type":41,"value":42,"context":43},"cve","CVE-2026-113971","Vulnerability affecting only iOS\u002FiPadOS version 26",{"type":41,"value":45,"context":46},"CVE-2026-113960","Vulnerability related to iMessage group access",{"type":41,"value":48,"context":49},"CVE-2026-113961","Vulnerability related to remote access to iMessage group chats",{"type":41,"value":51,"context":52},"CVE-2026-113963","Vulnerability allowing apps to access sensitive user data",{"type":41,"value":54,"context":55},"CVE-2026-113964","Vulnerability allowing Bluetooth pairing bypass in range",{"type":41,"value":57,"context":58},"CVE-2026-113965","Vulnerability allowing malicious Bluetooth device pairing without user interaction",{"type":41,"value":60,"context":61},"CVE-2026-113968","Vulnerability allowing AirPlay pairing code attempt rate limit bypass in Bluetooth range",{"type":41,"value":63,"context":64},"CVE-2026-113969","Vulnerability allowing AirPlay pairing code attempt rate limit bypass on the same network",{"type":41,"value":66,"context":67},"CVE-2026-113970","Vulnerability allowing Bluetooth device to corrupt process memory",[18,21,24],{"controls":70,"vendors":136},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":101,"name":102,"problem":103,"products":104},"patch-management","Automated patch management","Known holes get closed in days, not months.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":130,"name":131,"problem":132,"products":133},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[134,135],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},[137],{"slug":138,"name":18,"logo_path":139,"roles":140},"apple","\u002Fvendor-logos\u002Fapple.png",[141],"affected",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":152},"apple-patches-nine-vulnerabilities-including-bluetooth-and-ios-specific-flaws","Apple Patches Nine Vulnerabilities Including Bluetooth and iOS-Specific Flaws","Apple released coordinated updates across iOS, iPadOS, macOS, watchOS, and visionOS to address nine vulnerabilities, including CVE-2026-113971 specific to iOS\u002FiPadOS 26 and several Bluetooth-related weaknesses. Bluetooth vulnerabilities are particularly concerning because they can undermine device pairing security, potentially allowing unauthorized devices to connect or intercept communications. Organizations and individuals who delay applying these updates leave their devices exposed to exploitation across a wide attack surface spanning Apple's entire ecosystem. Timely patching of vendor-released updates remains one of the most effective defenses against known vulnerabilities.",[147,148,149,150,151],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(e)":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"CIS Control 7: Continuous Vulnerability Management (v8)":155,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":156,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":157},"This provision covers vulnerability handling and disclosure in the acquisition and maintenance of systems, requiring entities to have processes for applying vendor security patches such as these Apple updates.","SI-2 requires organizations to identify, report, and correct information system flaws, which covers the obligation to apply Apple's released patches within an organizationally defined timeframe.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, which directly applies here as timely application of Apple's patches would have closed all nine vulnerabilities.","A.8.8 explicitly requires organizations to obtain timely information about technical vulnerabilities and take appropriate measures, directly covering the need to apply Apple's nine patches promptly.","This category directly addresses the need to act on newly disclosed vulnerabilities like those in this Apple advisory, ensuring they are patched or formally risk-accepted."]