The vulnerability allows a malicious Bluetooth device to establish a pairing with Apple devices without user interaction, effectively bypassing standard authentication steps. This bypass could enable an attacker to later access sensitive data or services exposed through the paired device, thereby compromising confidentiality and potentially availability of device functionality. The weakness aligns with improper authentication controls.

Apple iOS, iPadOS, macOS, visionOS, and watchOS are affected. The fix is available for iOS 18.7.12 and later, iPadOS 18.7.12 and later, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1 and watchOS 27.2.1.

No CVSS score or EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog, indicating the current exploitation risk is unclear. However, the nature of the flaw—allowing automatic Bluetooth pairing—suggests that an attacker could circumvent user consent, potentially exploiting the device immediately upon proximity. Attackers could carry out such pairing with any device broadcasting via the Bluetooth protocol stack, making the threat portable. Organizations should treat this issue with caution until the patch is applied.