The Center for Internet Security is warning that flaws in Apple's software could let attackers take over affected devices, and updates are already available to fix them.
Apple has released software updates to fix a batch of security flaws across its product lineup, according to the Center for Internet Security. The most serious of the flaws could let an attacker run their own malicious code on a device, potentially letting them install programs, steal or alter data, or create new accounts with full access.
The vulnerabilities affect iPhones and iPads running versions older than iOS/iPadOS 27.2.1, 26.7.3, or 18.7.12, as well as Macs running older versions of macOS, Apple Watches on outdated watchOS, and Apple’s Vision Pro headset running older visionOS. According to the Center for Internet Security, there are no known reports of these flaws being exploited yet.
Several of the issues involve Bluetooth, the short-range wireless connection used for things like headphones and smart devices. According to the advisory, an attacker within Bluetooth range could, in some cases, bypass limits on pairing-code attempts or pair with a device without the owner’s permission, potentially corrupting the device’s memory in the process. Other flaws involve AirPlay, Apple’s screen- and audio-sharing feature, where an attacker on the same network, or someone with physical access to a locked device, could similarly force an unauthorized pairing.
A few flaws also affect iMessage. According to the Center for Internet Security, a remote attacker could potentially join a group chat and read its messages, and someone newly added to a group chat could see messages sent before they joined.
The Center for Internet Security rates the risk as high for large organizations and medium for small businesses and governments, but low for everyday home users.
What you can do: Apple has already made updates available for affected iPhones, iPads, Macs, Apple Watches, and Vision Pro headsets. The Center for Internet Security recommends installing these updates as soon as possible after testing, and notes that accounts without administrator-level permissions are generally less exposed if an attack does occur.
Based on a release from Center for Internet Security.
