The privilege escalation vulnerability CVE-2026-58704 in the cellular modem of Google Pixel smartphones was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 16 September 2026, with a remediation deadline of 19 September 2026. According to Google’s bulletin, the company has detected signs of “limited, targeted exploitation” of this vulnerability, but details of the attacks and attribution of the threat actors have not been disclosed. Pixel device owners must immediately install the security update with patch level 2026-09-05 or later.
Technical characteristics of CVE-2026-58704
According to the description in the NVD database, the vulnerability is a permission bypass caused by a logical error in the Pixel cellular modem code. The stated CVSS score is 8.0 (high severity), although the assigning authority is not specified in the available materials.
Key parameters of the vulnerability:
- Type: privilege escalation
- Attack vector: remote exploitation at the level of proximal or adjacent access
- User interaction: not required
- Additional privileges: not required
- Affected component: Cellular Modem of Google Pixel devices
The wording “proximal or adjacent access” indicates that the attacker likely needs to be within the cellular coverage range of the device or in the same network environment. This narrows the set of possible attack scenarios compared to fully remote exploitation over the internet but does not reduce the criticality for targeted attacks — precisely the type of exploitation Google is describing.
Scope of the September update
In addition to CVE-2026-58704, the September 2026 Pixel update reportedly fixes another 109 security vulnerabilities:
- 88 privilege escalation vulnerabilities
- 10 information disclosure vulnerabilities
- 9 remote code execution vulnerabilities
- 2 denial-of-service (DoS) vulnerabilities
Among them are two high-severity vulnerabilities in kernel components: CVE-2026-56914 and CVE-2026-58773 (both privilege escalation). Also noteworthy are 46 critical vulnerabilities in such Pixel components as BigOcean, the Bootloader, the IP Multimedia Subsystem, and the Trusted Execution Environment. These vulnerabilities can lead to privilege escalation and remote code execution.
The dominance of privilege escalation vulnerabilities (88 out of 109, i.e., more than 80%) points to a systemic issue with access control in various components of the Pixel platform.
Impact assessment
The inclusion of CVE-2026-58704 in the CISA KEV catalog means that the agency confirms the exploitation of the vulnerability and considers it a priority for remediation. For organizations subject to directive BOD 22-01, the three-day remediation window (from 16 to 19 September) is mandatory.
A vulnerability in the cellular modem is particularly dangerous because this component operates at a low level of the stack and processes data from external radio channels. Successful exploitation may give an attacker privileged access to the device without any action on the part of the owner.
The lack of attribution and attack details is typical for targeted operations that may be related to the activities of intelligence services or commercial surveillance vendors. However, there is currently no confirmation of any specific attribution.
It is worth noting that this is not the first case of vulnerability exploitation in Google products in 2026. In June, Google fixed the CVE-2025-48595 vulnerability (CVSS 8.4) in the Android Framework component, which, according to the company, was also under active exploitation. We have already written about this vulnerability earlier.
Remediation recommendations
Priority actions for Pixel device owners:
- Immediately check the security patch level on the device: Settings → Security and privacy. The target level is 2026-09-05 or later.
- Install the update if it is available. If there is no update yet, check for it daily until it appears.
- For organizations managing a fleet of Pixel devices: prioritize deploying the update with regard to the CISA KEV deadline of 19 September 2026.
Given the inclusion of CVE-2026-58704 in the CISA KEV catalog and the three-day remediation window, postponing the installation of the September Pixel security update is not an option. The update closes not only the exploited modem vulnerability but also 46 critical vulnerabilities in key platform components — from the Bootloader to the Trusted Execution Environment.
