Loading vulnerability…
Notification Services notification retention issue in Apple iOS and iPadOS
CVE-2026-28950 is a privacy and confidentiality vulnerability in Apple Notification Services affecting multiple supported iOS and iPadOS release branches. Apple described the issue as a logging problem that was corrected through improved data redaction. As a result of the flaw, notifications that had been marked for deletion could be unexpectedly retained on the device instead of being fully removed as intended. The vulnerability appears to involve residual notification content being preserved in local logging or notification-related storage, creating unintended persistence of message previews or other notification data after deletion.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation or forensic access to affected devices can expose notification content that users or applications expected to be deleted. This can result in unauthorized recovery of sensitive message previews and other notification-derived data from local device storage, creating a confidentiality and privacy breach. The issue is a data-remanence problem rather than a code-execution or availability issue, but it can materially undermine the privacy guarantees of applications whose sensitive content is surfaced through OS-level notifications.
If you can’t patch tonight, do this now.
Where immediate patching is not possible, reduce exposure by limiting or disabling sensitive notification previews for high-risk applications and users, especially on lock screens. Configure apps and device settings to minimize message content shown in notifications, and restrict physical access to unlocked devices. These measures are defense in depth only and do not replace installation of the vendor fixes.
Patch, then assume compromise.
Apply Apple's security updates that fix CVE-2026-28950. The issue was addressed in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.7.16 and iPadOS 16.7.16, iPadOS 17.7.11, iOS 18.7.8 and iPadOS 18.7.8, and iOS 26.4.2 and iPadOS 26.4.2. Organizations should validate fleet compliance across all supported iPhone and iPad models and ensure devices are updated to the appropriate fixed branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.