CVE-2026-28950
Modified Modified - Updated After Analysis
Improper Data Redaction in iOS Notification Logging Retains Deleted Alerts

Publication date: 2026-04-22

Last updated on: 2026-05-17

Assigner: Apple Inc.

Description
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.7.16 and iPadOS 16.7.16, iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2, iPadOS 17.7.11. Notifications marked for deletion could be unexpectedly retained on the device.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-22
Last Modified
2026-05-17
Generated
2026-06-16
AI Q&A
2026-04-22
EPSS Evaluated
2026-06-15
NVD
CVE-2026-28950
EUVD
EUVD-2026-25052
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
apple ipados to 18.7.8 (exc)
apple ipados From 26.0 (inc) to 26.4.2 (exc)
apple iphone_os to 18.7.8 (exc)
apple iphone_os From 26.0 (inc) to 26.4.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-359 The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves a logging issue where notifications that were marked for deletion could be unexpectedly retained on the device. The problem was addressed by improving data redaction in the logging process.

Impact Analysis

The impact of this vulnerability is that notifications intended to be deleted might remain on the device, potentially exposing sensitive information that should have been removed.

Mitigation Strategies

To mitigate this vulnerability, update your devices to the fixed versions of the operating systems: iOS 18.7.8, iPadOS 18.7.8, iOS 26.4.2, or iPadOS 26.4.2.

Compliance Impact

This vulnerability involves a logging issue where notifications marked for deletion could be unexpectedly retained on the device, which was addressed by improved data redaction in iOS and iPadOS updates.

Retention of deleted notifications could potentially impact compliance with data protection regulations such as GDPR and HIPAA, which require proper handling and deletion of personal and sensitive information.

By improving data redaction and ensuring notifications marked for deletion are properly removed, the fix helps maintain compliance with these standards by reducing the risk of unauthorized retention of personal data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28950. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart