Apple released iPadOS 17.7.11 on May 11, 2026[1]. The update targets only three legacy devices — the iPad Pro 12.9-inch (2nd generation), the iPad Pro 10.5-inch, and the iPad (6th generation) — all of which sit outside Apple's current iPad lineup[1]. The release contains a single fix, CVE-2026-28950, and brings the Notification Services data-retention patch that originally shipped on April 22 as part of iOS 26.4.2 and iOS 18.7.8 to these older iPads roughly three weeks behind schedule[1][4].
Release date, supported devices, and the lone fix
Apple's security release page 127112 lists iPadOS 17.7.11 with a publication date of May 11, 2026[1]. The supported devices are limited to the iPad Pro 12.9-inch (2nd generation), the iPad Pro 10.5-inch, and the iPad (6th generation), none of which can move to iPadOS 18[1][2]. To keep those three devices patched, Apple has continued to maintain a separate iPadOS 17 branch, and 17.7.11 functions purely as a security maintenance release in that branch[2].
The single vulnerability addressed is CVE-2026-28950, located in Notification Services[1]. Apple's advisory describes the impact as "notifications marked for deletion could be unexpectedly retained on the device," and notes that the fix involved improved data redaction in a logging routine[1]. No Kernel, WebKit, or Wi-Fi fixes are included this time, putting the update well below the 47 CVE total for iOS 18.7.9 / iPadOS 18.7.9 and the more than 60 CVEs in iOS 26.5 / iPadOS 26.5 that Apple shipped on the same day[2][3].
CVE-2026-28950 — a delayed backport of the FBI Signal-recovery bug
CVE-2026-28950 was originally patched on April 22, 2026, when Apple shipped out-of-band updates as iOS 26.4.2 / iPadOS 26.4.2 for current devices and iOS 18.7.8 / iPadOS 18.7.8 for the previous-generation hardware[4]. The vulnerability came to light after reports that the U.S. Federal Bureau of Investigation (FBI) had reconstructed deleted Signal messages from a seized iPhone by pulling them out of the iOS notification database — even after the Signal app itself had been removed[4].
In technical terms, the payloads of push notifications delivered to Signal and similar messaging apps were being retained inside an internal iOS log, surviving both the user clearing the notification and uninstalling the app[4]. Physical access to the device is required to exploit the bug, but it effectively let the contents of end-to-end encrypted messages be read straight out of the notification log, bypassing the encryption protections that should have applied[4]. iPadOS 17.7.11 carries the same fix to the three legacy iPads, with the CVE ID, affected component, and remediation language matching the April advisory verbatim[1][4]. Apple's redaction change is paired with the deletion of any already-cached notification log entries, so once the update is installed users do not need to take any additional action to clear retained data[4].
The May 11 legacy-OS roll-up and the longevity of iPadOS 17
iPadOS 17.7.11 is part of the wider sweep of legacy-branch updates that Apple released on May 11[2][3]. According to summaries by AppleInsider and 9to5Mac, the same day's roll-up included macOS Tahoe 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, iOS / iPadOS 18.7.9, iOS 16.7.16, and iOS 15.8.8[2][3]. Among those, iPadOS 17.7.11 has the narrowest device list and the smallest fix count, but the fact that Apple is still pushing security patches to 8-year-old hardware — including the iPad (6th generation) launched in 2018 — marks a noteworthy milestone in the company's long-term support story[1][2].
The hardware involved is a snapshot of mid-2017 and early-2018 iPads: the iPad (6th generation) shipped in March 2018, while the iPad Pro 10.5-inch and the iPad Pro 12.9-inch (2nd generation) both shipped in June 2017[2]. All three rely on the A10 Fusion or A10X Fusion chip, neither of which clears the A12 Bionic minimum required by iPadOS 18, so Apple's pattern is to deny them new features but keep delivering security fixes through 17-branch spin-offs[1][2].
Summary
iPadOS 17.7.11 is a small maintenance release that addresses only CVE-2026-28950, finally delivering to three legacy iPads the Notification Services data-retention patch that current iOS branches received on April 22. There are no new features, but the underlying bug enabled real-world recovery of deleted Signal messages by the FBI, so users on the affected devices should install the update quickly.
Source:[1] https://support.apple.com/en-us/127112
Source:[4] https://support.apple.com/en-us/127003
