What is the CVSS score of CVE-2026-28950?

CVE-2026-28950 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-28950?

Yes, a patch is available for CVE-2026-28950. Update the affected software to the latest version immediately.

Apple iOS iPadOS CVE-2026-28950

EUVD-2026-25052 MEDIUM

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2026-04-22 apple

GHSA-3hwj-7r29-g5vv

Information Disclosure Apple Ios And Ipados

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.2 MEDIUM

Local vector required for file system access; no auth needed once device is physically accessible; confidentiality-only impact as notification content is read but not modified.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:14 vuln.today

Patch released

Apr 29, 2026 - 20:16 nvd

Patch available

CVSS changed

Apr 23, 2026 - 21:27 NVD

6.2 (None) 6.2 (MEDIUM)

Patch available

Apr 22, 2026 - 20:32 EUVD

EUVD ID Assigned

Apr 22, 2026 - 18:31 euvd

EUVD-2026-25052

CVE Published

Apr 22, 2026 - 18:22 nvd

MEDIUM 6.2

DescriptionCVE.org

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2. Notifications marked for deletion could be unexpectedly retained on the device.

AnalysisAI

Notification data retention in Apple iOS and iPadOS exposes deleted notification content to local access due to insufficient log redaction. Devices running iOS/iPadOS prior to 18.7.8 or 26.4.2 retain notification payloads after user deletion, constituting a CWE-359 private information exposure. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.02% (5th percentile), and SSVC assessment classifies exploitation as none - indicating low real-world threat velocity despite a CVSS confidentiality impact of High.

Technical ContextAI

The vulnerability resides in the notification subsystem of Apple iOS and iPadOS, where log entries or on-device storage buffers failed to properly redact notification content when the notification was marked for deletion. CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) identifies the root cause: sensitive data - in this case notification payloads that users or the OS intended to discard - was not purged from logging infrastructure, leaving it accessible locally. The fix involved improved data redaction logic in the logging layer. Affected products per CPE: cpe:2.3:a:apple:ios_and_ipados covering all versions below 18.7.8 (legacy branch) and below 26.4.2 (current branch). The attack vector is strictly local (AV:L), meaning exploitation requires physical or logical access to the device's storage.

RemediationAI

Update to iOS 18.7.8 or iPadOS 18.7.8 (legacy branch) or iOS 26.4.2 or iPadOS 26.4.2 (current branch) via Settings > General > Software Update. Vendor patch is confirmed available per Apple security advisories at https://support.apple.com/en-us/127002 and https://support.apple.com/en-us/127003. For environments where immediate patching is not feasible - such as managed MDM fleets pending validation - a compensating control is to enable full-device encryption via passcode enforcement (already default on modern iOS) to ensure log storage is protected at rest, reducing the risk from physical-access scenarios. Organizations handling sensitive notifications (healthcare, finance, legal) should treat this as a priority update given the C:H confidentiality impact on notification content. No workarounds are documented by Apple that substitute for the patch.