CVE-2026-58704 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2026-09-15

Added to CISA KEV: 2026-09-16 1 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

IMMEDIATE: Apply the September 2026 Pixel Security Bulletin update to all Google Pixel devices — this is the only definitive remediation.
ENTERPRISE: Prioritize patching for high-value targets (executives, government officials, journalists, security researchers) who may be targeted by sophisticated proximal attackers.
MONITORING: Since modem-level compromise operates below the Android OS, traditional endpoint security tools may not detect exploitation. Monitor for anomalous cellular modem behavior, unexpected network traffic, or device integrity failures.
THREAT INTEL: Given the targeted exploitation pattern consistent with state-aligned actors, organizations with sensitive personnel should treat unpatched devices as potentially compromised if operating in high-risk environments.
INTERIM MITIGATION: In high-risk scenarios where patching is delayed, consider disabling cellular connectivity and relying on Wi-Fi only — this reduces the adjacent attack surface, though it is not a permanent solution.
PATCH PRIORITY: HIGH for government, defense, critical infrastructure, and enterprise environments with sensitive personnel; MEDIUM for general consumer deployments given the proximity requirement limiting mass exploitation.

🔍 Web Intelligence (Kagi · 2026-09-16)

Summary

CVE-2026-58704 is a critical high-severity vulnerability affecting the cellular modem firmware within Google Pixel devices, stemming from a logic error that results in a permission bypass. This flaw is significant because it potentially allows a remote, adjacent attacker to escalate privileges and gain unauthorized control over the device, including root-level access. The vulnerability has been deemed particularly dangerous due to evidence indicating it has been subjected to limited, targeted exploitation in the wild, prompting Google to address it in the September 2026 Pixel security update.

Exploitation

Active Exploitation: There are credible indications that this vulnerability has been under limited, targeted exploitation in the wild.
Threat Actors: While specific threat actors are not named, the nature of "limited, targeted exploitation" typically suggests sophisticated adversaries or state-aligned groups.
PoC/Exploit Tools: No public proof-of-concept (PoC) code or exploit kits have been widely released to the public as of September 16, 2026.
Attack Prerequisites:

- Network Access: The attack vector is classified as adjacent, meaning the attacker must be within the same radio frequency range or network segment (such as being on the same cellular network or close-proximity network). - Authentication: No authentication is required for the attacker to initiate the exploitation. - User Interaction: No specific user interaction is required for the initial exploitation of the modem component.

Affected Products & Patches

Affected Products: Google Pixel series devices utilizing the specific vulnerable cellular modem firmware.
Patch Availability: Google addressed this vulnerability as part of the September 2026 Pixel Security Bulletin, released officially on September 15, 2026.
Mitigations:

- Users are strongly advised to update their Pixel devices to the latest firmware version released in the September 2026 patch cycle. - In the absence of an immediate update, temporary mitigations include limiting cellular connectivity when possible and disabling unnecessary modem-related services, though these are not permanent solutions.

Impact

System Access: Successful exploitation can allow an attacker to bypass security permissions, potentially leading to unauthorized remote access and, in severe cases, escalation to root-level privileges on the device.
Business/User Risk: For individual users and enterprise deployments, this vulnerability poses a severe risk of data exfiltration, device compromise, and loss of device integrity. Because the modem operates independently of the main Android OS, compromise at this level can be extremely difficult to detect and clean once the attacker gains persistence.