CVE-2026-28987
Improper Data Redaction in Apple iOS and macOS
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | ios | 18.7.9 |
| apple | ipados | 18.7.9 |
| apple | macos_sequoia | 15.7.7 |
| apple | macos_sonoma | 14.8.7 |
| apple | macos_tahoe | 26.5 |
| apple | tvos | 26.5 |
| apple | watchos | 26.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is related to a logging issue where sensitive kernel state information could be leaked due to insufficient data redaction in logs.
It affects various Apple operating systems including iOS, iPadOS, macOS (Sequoia, Sonoma, Tahoe), tvOS, and watchOS.
The issue has been addressed by improving data redaction in logs to prevent sensitive information from being exposed.
How can this vulnerability impact me? :
An application may be able to leak sensitive kernel state information due to this vulnerability.
This could potentially allow unauthorized access to sensitive system information, which might be exploited for further attacks or to compromise system security.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your Apple devices to the fixed versions of the operating systems as soon as possible.
- Update iOS devices to iOS 18.7.9 or iOS 26.5.
- Update iPadOS devices to iPadOS 18.7.9 or iPadOS 26.5.
- Update macOS devices to macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, or macOS Tahoe 26.5.
- Update Apple TV devices to tvOS 26.5.
- Update Apple Watch devices to watchOS 26.5.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves a logging issue where sensitive kernel state information may be leaked by an app. Such leakage of sensitive data could potentially impact compliance with data protection standards and regulations like GDPR and HIPAA, which require the protection of sensitive information.
However, the provided information does not specify explicit effects or assessments related to compliance with these standards.