CVE-2026-58704: Google Pixel Modem Flaw
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-09-16. Federal agencies must patch by 2026-09-19.
TL;DR - CVE-2026-58704 is a permission-bypass flaw caused by a logic error in the Google Pixel cellular modem. - Supported Pixel devices should be updated to the September 2026 security level, 2026-09-05 or later. - CISA KEV confirms exploitation in the wild; Google describes possible limited, targeted exploitation.
Summary
CVE-2026-58704 is an improper authorization vulnerability in the cellular modem component of Google Pixel devices. The available NVD description says a logic error can permit a permission bypass, potentially allowing a nearby or adjacent attacker to escalate privileges without user interaction or additional execution privileges.
The issue is a serious Google Pixel vulnerability because it affects a low-level communications component and has confirmed exploitation through the CISA Known Exploited Vulnerabilities catalog. Organizations should prioritize patch verification for every supported Pixel device.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-58704 |
| Vulnerability | Google Pixel improper authorization vulnerability |
| CVSS | 8.8 |
| Attack vector | Remote, proximal or adjacent; exact radio interface is not disclosed |
| Authentication required | Not specified in the available record |
| User interaction | Not required |
| Affected component | Cellular modem |
| Patch available | Yes |
| Fixed version | September 2026 Pixel update, security patch level 2026-09-05 or later |
| Exploitation status | Confirmed in the wild through CISA KEV inclusion |
The risk is higher than the score alone may suggest. The vulnerability affects a low-level communications component, requires no user interaction, and has confirmed real-world exploitation. The available evidence does not establish that every Android device is affected or that the flaw is directly exploitable over the public Internet.
For background, see our glossary of penetration testing and glossary of rootkits.
Root Cause
The disclosed root cause is a logic error in the cellular modem’s authorization path. That error can result in an improper permission decision, allowing an operation that should have been restricted. Public descriptions do not identify the affected function, the authorization check that fails, the modem protocol involved, or the exact privilege boundary crossed.
The NVD wording describes “remote (proximal/adjacent) escalation of privilege.” In practical terms, an attacker must be in a nearby or otherwise adjacent attack position, but the record does not define the required physical distance, radio technology, baseband interface, or environmental conditions. Defenders should not assume that ordinary Internet reachability is sufficient for exploitation.
No source-level patch analysis or detailed exploit chain was available in the supplied primary material. Organizations should therefore treat the flaw as a vendor-confirmed authorization failure rather than relying on assumptions about which cellular features or network configurations make exploitation impossible.
Who’s Exposed
The identified affected technology is Google Pixel, specifically the cellular modem component in supported Pixel devices. The NVD data reviewed for this article does not provide a complete model-by-model list or an explicit vulnerable-version range. Google’s September 2026 Pixel Update Bulletin is therefore the authoritative source for determining whether an individual model and build are covered.
For operational purposes, supported Pixel devices running a security patch level earlier than 2026-09-05 should be treated as potentially exposed until Google or the organization’s device-management system confirms otherwise. The fixed reference available in the research is the September 2026 Pixel security update with the 2026-09-05 patch level. A separate modem firmware version and exact build number were not provided.
| Scope | Assessment |
|---|---|
| Google Pixel devices | Potentially affected if below the September 2026 remediation level |
| Pixel devices at 2026-09-05 or later | Remediated according to the available Google update reference |
| Samsung, OnePlus, Motorola, and other Android devices | No evidence in the reviewed sources establishes that they are affected |
| Unsupported or no-longer-updatable Pixel devices | Risk remains unless Google provides an applicable mitigation |
Inventory teams should collect both the device model and Android security patch level. A device that reports a recent Android platform version but an older security patch level should remain in the remediation queue.
Severity Breakdown
CVE-2026-58704 has a reported CVSS score of 8.8, placing it in the high-severity category. The available record identifies no user interaction requirement and describes a privilege-escalation impact through a proximal or adjacent attack path.
The complete CVSS vector was not returned in the NVD data available for this article. Reconstructing individual vector components such as attack complexity, privileges required, scope, confidentiality, integrity, or availability impact would therefore be unsafe. The following table separates confirmed information from unresolved scoring details.
| CVSS element | Available assessment |
|---|---|
| Base score | 8.8 |
| Attack vector | Proximal or adjacent remote access is described |
| Attack complexity | Not disclosed in the available record |
| Privileges required | The description says no additional execution privileges are needed; the authentication requirement is not explicitly stated |
| User interaction | Not required |
| Scope | Not disclosed |
| Confidentiality impact | Not disclosed |
| Integrity impact | Not disclosed |
| Availability impact | Not disclosed |
Security teams should use the 8.8 score for prioritization but should not treat it as a complete description of exploitability. CISA KEV status and confirmed exploitation are more important operational signals than uncertainty around the unpublished vector components.
Exploitation Status
Exploitation in the wild is confirmed through CISA Known Exploited Vulnerabilities catalog inclusion. CISA added CVE-2026-58704 on 2026-09-16 with a remediation due date of 2026-09-19. CISA’s catalog is intended to identify vulnerabilities exploited in real-world attacks. This does not prove ransomware use; CISA records ransomware campaign use for this vulnerability as unknown.
Google’s September 2026 Pixel bulletin reportedly states that the vulnerability may be under limited, targeted exploitation. That wording suggests exploitation is not necessarily broad or opportunistic, but it still warrants immediate action for supported devices, especially those used by executives, administrators, journalists, public officials, or personnel operating in locations where nearby wireless attacks are plausible.
No verified public proof-of-concept repository or exploit code was identified in the reviewed sources. The current status should therefore be recorded as follows:
| Question | Status |
|---|---|
| In-the-wild exploitation | Confirmed through CISA KEV |
| Google assessment | Possible limited, targeted exploitation |
| Public PoC | Not confirmed |
| Public exploit code | Not identified in reviewed sources |
| Threat actor | Unknown |
| Ransomware use | Unknown |
The absence of a public PoC does not reduce the priority. KEV inclusion indicates that defenders should assume capable attackers may possess private exploit knowledge or tooling.
Analyst’s Take: Patch-level verification should come before attempting to build exploit detection for this issue. CISA confirms exploitation, while Google describes it as possible limited, targeted activity; that combination supports urgent remediation without implying broad or opportunistic attacks.
Sources
The primary NVD record identifies CVE-2026-58704 as an improper authorization issue in the Pixel cellular modem and provides the 8.8 CVSS score and proximal or adjacent exploitation description: NVD: CVE-2026-58704.
Google’s September 2026 Pixel bulletin is the authoritative vendor reference for affected supported devices and the remediation patch level. The available research associates the fix with the 2026-09-05 security patch level: Google Pixel Update Bulletin, September 2026.
CISA’s Known Exploited Vulnerabilities catalog confirms exploitation in the wild and records the catalog addition date, remediation deadline, and unknown ransomware-use status: CISA KEV: CVE-2026-58704.
Because the retrieved vendor material did not expose a complete model-by-model version matrix, administrators should verify applicability against Google’s live bulletin and each device’s reported security patch level before closing the remediation task.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should begin with asset identification and patch-level verification because no public exploit signature, modem event signature, or reliable post-exploitation indicator is available. Organizations should identify every managed Pixel device, record its model and security patch level, and flag devices below 2026-09-05.
Mobile-device-management platforms should generate an alert when a supported Pixel reports an older patch level, becomes noncompliant, or fails to install the September 2026 update. Network teams should not rely solely on perimeter telemetry. The described attack path is proximal or adjacent, and the relevant traffic may involve cellular or local radio protocols that are not visible in conventional enterprise firewall logs.
Technical Notes
A basic Android Debug Bridge check for a managed test device is:
adb shell getprop ro.product.manufacturer
adb shell getprop ro.product.model
adb shell getprop ro.build.version.security_patch
A device-compliance query in an inventory database can be expressed as:
SELECT device_id, model, security_patch_level
FROM mobile_devices
WHERE LOWER(manufacturer) = 'google'
AND security_patch_level < '2026-09-05';
The exact field names will vary by MDM or asset platform. The query is a patch-state detection method, not an exploit detector. There is currently no validated public log pattern or network signature that can reliably confirm exploitation of CVE-2026-58704.
Preserve modem, device, and MDM telemetry where available. Investigate unexplained privilege changes, modem resets, unusual nearby-device activity, or targeted-device compromise alongside other evidence.
Remediation Steps
Install the latest available Google Pixel security update and verify that the device reports a security patch level of 2026-09-05 or later. Because the available research does not provide a separate modem firmware identifier or complete model-specific build list, administrators should use Google’s Pixel update channel and the device’s own patch-level report to confirm remediation.
Prioritize devices assigned to high-risk personnel and devices routinely used in public or uncontrolled locations. If a supported Pixel cannot be updated, apply any mitigation Google provides for that model. If no vendor mitigation is available, remove the device from sensitive use or replace it with a supported device.
Do not assume that airplane mode, disabling mobile data, or using a corporate VPN is a validated permanent workaround for a cellular-modem authorization flaw. For personal devices, reputable mobile security software such as Malwarebytes may provide additional device protection, but it cannot replace the Google security update or remediate the modem vulnerability itself.
Technical Notes
On a device connected for administrative testing, the Android update settings screen can be opened with:
adb shell am start -a android.settings.SYSTEM_UPDATE_SETTINGS
Where the model, region, and signing requirements are verified, an administrator may use Google’s official OTA package through recovery:
adb reboot recovery
# Then select "Apply update from ADB" on the device
adb sideload <official-google-pixel-ota-package.zip>
Only use an official package that exactly matches the Pixel model and approved build path. Validate the result after reboot:
adb shell getprop ro.build.version.security_patch
The expected result is 2026-09-05 or a later patch level. Enterprise administrators should prefer the organization’s MDM update command and compliance policy over unmanaged sideloading. No separate, vendor-confirmed workaround was identified in the available material.
Incident Response Considerations
If a potentially exposed Pixel was assigned to a high-risk user or operated in a location where nearby wireless attacks were plausible, preserve relevant evidence before wiping or replacing the device. Collect MDM compliance records, Android security patch history, device inventory data, modem and system logs where available, and any related account or endpoint telemetry.
A missing exploit signature does not rule out compromise. Correlate unusual privilege changes, unexpected device-management events, account activity, modem resets, and suspicious activity affecting nearby devices. Organizations should follow their established mobile incident-response process and avoid treating a patched device as proof that no earlier compromise occurred.
For broader evidence-handling guidance, use a documented incident-response workflow and preserve volatile data when technically and legally appropriate.