CVE-2026-28950

Modified Modified - Updated After Analysis

Improper Data Redaction in iOS Notification Logging Retains Deleted Alerts

Publication date: 2026-04-22

Last updated on: 2026-05-17

Assigner: Apple Inc.

Description

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.7.16 and iPadOS 16.7.16, iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2, iPadOS 17.7.11. Notifications marked for deletion could be unexpectedly retained on the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-22

Last Modified

2026-05-17

Generated

2026-07-06

AI Q&A

2026-04-22

EPSS Evaluated

2026-07-05

NVD

CVE-2026-28950

EUVD

EUVD-2026-25052

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 18.7.8 (exc)
apple	ipados	From 26.0 (inc) to 26.4.2 (exc)
apple	iphone_os	to 18.7.8 (exc)
apple	iphone_os	From 26.0 (inc) to 26.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-359	The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Attack-Flow Graph

Executive Summary

This vulnerability involves a logging issue where notifications that were marked for deletion could be unexpectedly retained on the device. The problem was addressed by improving data redaction in the logging process.

Compliance Impact

This vulnerability involves a logging issue where notifications marked for deletion could be unexpectedly retained on the device, which was addressed by improved data redaction in iOS and iPadOS updates.

Retention of deleted notifications could potentially impact compliance with data protection regulations such as GDPR and HIPAA, which require proper handling and deletion of personal and sensitive information.

By improving data redaction and ensuring notifications marked for deletion are properly removed, the fix helps maintain compliance with these standards by reducing the risk of unauthorized retention of personal data.

Impact Analysis

The impact of this vulnerability is that notifications intended to be deleted might remain on the device, potentially exposing sensitive information that should have been removed.

Mitigation Strategies

To mitigate this vulnerability, update your devices to the fixed versions of the operating systems: iOS 18.7.8, iPadOS 18.7.8, iOS 26.4.2, or iPadOS 26.4.2.

Hi! I’m here to help you understand CVE-2026-28950. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70