CVE-2026-28950

CVE Enrichment

CVSS: 6.2 MEDIUM
EPSS: 2.88%
EPSS Percentile: 86.89%
CISA KEV: Not listed

Description

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.7.16 and iPadOS 16.7.16, iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2, iPadOS 17.7.11. Notifications marked for deletion could be unexpectedly retained on the device.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 23-Apr-2026 02:17
Last Modified: 27-Oct-2026 04:10
EPSS Date: 2026-11-04
CWE: CWE-359

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:N

CNA Products / Version Status

Apple · iOS and iPadOS Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 15.8.8 — affected (custom)
0 ≤ version < 16.7.16 — affected (custom)
0 ≤ version < 18.7.8 — affected (custom)
0 ≤ version < 26.4.2 — affected (custom)
Apple · iPadOS Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 17.7.11 — affected (custom)

Affected Products / Versions

apple / ipados Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 18.7.8
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
apple / ipados Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 26.0 · before (exclusive) 26.4.2
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
apple / iphone_os Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 18.7.8
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
apple / iphone_os Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 26.0 · before (exclusive) 26.4.2
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

References

Last enrichment sync: 05-Nov-2026 06:46
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Apple fixes iPhone bug that let FBI retrieve deleted Signal messages(CVE-2026-28950) Week in Review: Claude Mythos Finds 271 Firefox Vulnerabilities; Vercel Reports Breach
Tracked as CVE-2026-28950, the bug is described as a logging issue resulting in notifications that have been marked for deletion to be retained on the device. Apple Patches iOS Flaw That Retained Deleted Notification Previews
Apple released outâofâband security updates for iPhone and iPad to fix a Notification Services flaw (CVE-2026-28950) that could allow notifications marked for deletion to remain stored on the device. Apple Patches iOS Bug That Could Retain Deleted Notifications

CVE (2)

Malware (3)

People (4)

Threat Actors (3)

MITRE ATT&CK (5)

Vendors (8)

Products (13)

Tools (7)

Industries (2)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.