CVE-2026-28950
Improper Data Redaction in iOS Notification Logging Retains Deleted Alerts
Publication date: 2026-04-22
Last updated on: 2026-04-29
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | ipados | to 18.7.8 (exc) |
| apple | ipados | From 26.0 (inc) to 26.4.2 (exc) |
| apple | iphone_os | to 18.7.8 (exc) |
| apple | iphone_os | From 26.0 (inc) to 26.4.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-359 | The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves a logging issue where notifications that were marked for deletion could be unexpectedly retained on the device. The problem was addressed by improving data redaction in the logging process.
How can this vulnerability impact me? :
The impact of this vulnerability is that notifications intended to be deleted might remain on the device, potentially exposing sensitive information that should have been removed.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your devices to the fixed versions of the operating systems: iOS 18.7.8, iPadOS 18.7.8, iOS 26.4.2, or iPadOS 26.4.2.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves a logging issue where notifications marked for deletion could be unexpectedly retained on the device, which was addressed by improved data redaction in iOS and iPadOS updates.
Retention of deleted notifications could potentially impact compliance with data protection regulations such as GDPR and HIPAA, which require proper handling and deletion of personal and sensitive information.
By improving data redaction and ensuring notifications marked for deletion are properly removed, the fix helps maintain compliance with these standards by reducing the risk of unauthorized retention of personal data.