CVE-2026-28950: Apple iPadOS Information Disclosure Flaw

CVE-2026-28950 Overview

CVE-2026-28950 is an information disclosure vulnerability in Apple iOS and iPadOS caused by improper data redaction in the logging subsystem. Notifications that users marked for deletion could be unexpectedly retained on the device, leaving sensitive notification content accessible after the user expected it to be removed. Apple addressed the issue by improving data redaction in the affected logging paths. The vulnerability affects multiple supported iOS and iPadOS release trains and is classified under [CWE-359] Exposure of Private Personal Information to an Unauthorized Actor.

Critical Impact
An attacker with local access to an unlocked device can retrieve notification content that the user intended to delete, leading to disclosure of private messages, authentication codes, or other sensitive data.

Affected Products

Apple iOS and iPadOS prior to 15.8.8, 16.7.16, 17.7.11, 18.7.8, and 26.4.2
Apple iPhone devices running the impacted iOS releases
Apple iPad devices running the impacted iPadOS releases

Discovery Timeline

2026-04-22 - CVE-2026-28950 published to NVD
2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-28950

Vulnerability Analysis

The flaw resides in how iOS and iPadOS handle notification lifecycle events. When a user dismissed or deleted a notification, the system did not fully redact or remove the associated notification data from on-device logs and caches. As a result, notification content persisted beyond the point at which the user expected it to be gone. The issue is local in nature and requires no user interaction or privileges, but does require access to the device to read the retained data. It impacts confidentiality only, with no effect on integrity or availability.

Root Cause

The root cause is incomplete data redaction within Apple's notification logging path. Log entries referencing notification payloads were retained even after the user-initiated deletion event fired. Apple's advisory describes the resolution as "improved data redaction," indicating that sanitization routines now strip notification content from log records at the time the deletion is processed.

Attack Vector

Exploitation requires local access to the device. An attacker who gains access to an unlocked iPhone or iPad, or who can read device diagnostic data, can recover notification text that the legitimate user believed was deleted. This is particularly relevant for one-time passcodes, multi-factor authentication prompts, encrypted messaging previews, and other sensitive content commonly delivered through notifications.

No public exploit code is available, and the CVE is not listed on the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.015%, reflecting low predicted exploitation activity.

Detection Methods for CVE-2026-28950

Indicators of Compromise

Presence of notification payload strings in on-device diagnostic logs or sysdiagnose bundles after the user dismissed the corresponding notifications.
iOS or iPadOS devices in the fleet still running versions earlier than 15.8.8, 16.7.16, 17.7.11, 18.7.8, or 26.4.2.

Detection Strategies

Inventory managed iOS and iPadOS devices through your mobile device management (MDM) platform and flag any build versions below the fixed releases listed in the Apple advisories.
Review sysdiagnose archives collected from suspect devices for retained notification content that should have been purged.
Correlate device compliance posture with sensitive application usage, prioritizing devices that receive MFA codes or messaging notifications.

Monitoring Recommendations

Configure MDM compliance policies to require the patched iOS or iPadOS build and quarantine devices that fall out of compliance.
Monitor for unauthorized physical access events and lost-or-stolen device reports, since exploitation requires local access.
Track Apple security advisory updates referenced at Apple Security Advisory #127002 and Apple Security Advisory #127003 for related notification subsystem changes.

How to Mitigate CVE-2026-28950

Immediate Actions Required

Update all iPhone and iPad devices to iOS or iPadOS 15.8.8, 16.7.16, 17.7.11, 18.7.8, or 26.4.2, whichever applies to the device's supported release train.
Enforce the minimum patched build through MDM and block non-compliant devices from accessing corporate resources.
Rotate any one-time passcodes or credentials that may have been delivered as notifications to shared or recently exposed devices.

Patch Information

Apple released fixes in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.7.16 and iPadOS 16.7.16, iPadOS 17.7.11, iOS 18.7.8 and iPadOS 18.7.8, and iOS 26.4.2 and iPadOS 26.4.2. Patch details are documented in Apple Security Advisory #127002, Apple Security Advisory #127003, Apple Security Advisory #127112, Apple Security Advisory #127113, and Apple Security Advisory #127114.

Workarounds

Restrict notification previews on the lock screen by setting Notifications to "When Unlocked" or "Never" until devices are updated.
Disable notification content for sensitive applications such as authenticator and messaging apps on unpatched devices.
Require device passcodes, Face ID, or Touch ID and reduce auto-lock timeout to limit the window for local access.

bash

# Configuration example: verify the iOS build on a managed device
# Run from a macOS host with the device connected and trusted
system_profiler SPUSBDataType | grep -A 4 "iPhone\|iPad"
ideviceinfo -k ProductVersion
# Confirm the reported version matches a fixed build:
#   15.8.8, 16.7.16, 17.7.11, 18.7.8, or 26.4.2