Google Pixel Modem CVE-2026-58704: Exploited Zero-Day

What to do

1. Pull the security patch level of every managed Pixel from your MDM and list any device below 2026-09-05.
2. Set a compliance rule that blocks corporate access for Pixel devices below patch level 2026-09-05.
3. Push or prompt the update on non-compliant devices, starting with high-risk users.
4. Retire Pixel models that no longer get security updates (Pixel 5a and older), since they will not receive this fix.
5. For high-risk users whose phones stayed unpatched, arrange a professional mobile forensic review.

How to check if you are affected or compromised

• Check a device's patch level with adb shell getprop ro.build.version.security_patch, or in Settings; anything below 2026-09-05 was exposed.
• Google has published no indicators of compromise or attacker details as of Oct 21, 2026, so a clean patch level is the main signal.
• For targeted users, look for unexplained reboots, battery drain or data use, and escalate to a mobile forensics specialist rather than relying on on-device checks.

What happened#

On September 15, 2026, Google published the Pixel Update Bulletin for September 2026. One fix was for CVE-2026-58704, an elevation-of-privilege bug in the Pixel's Modem component, rated High. The bulletin carries a rare note: "There are indications that CVE-2026-58704 may be under limited, targeted exploitation." Google's CVE text says that in the cellular modem "there is a possible permission bypass due to a logic error in the code." It "could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed." User interaction is not needed.

CISA added the bug to the KEV catalog on September 16 and gave federal agencies until September 19. The entry is also flagged for CISA's forensic triage requirements. Google has not named the attacker, the victims or how the exploit was delivered. SecurityWeek notes that Google "has not attributed the exploitation to a specific threat actor." No outside reporter is credited.

Who is affected#

Google Pixel phones below security patch level 2026-09-05 are affected. The bulletin says "All supported Google devices will receive an update to the 2026-09-05 patch level," but it does not list which models carry the flaw. Per Google's support page, Pixel 6 and later, plus the Pixel Fold, are in their update windows. Pixel 5a and older get no security updates at all. The bug ID has an asterisk, which means the fix is not public source code and ships in Pixel binary drivers. Google's bulletin covers only Google devices. Whether other phones share the flawed code has not been disclosed.

The sources disagree on a few details. Google, the CNA, gave no CVSS score. The 8.8 figure (AV:A, no privileges, no interaction) comes from CISA's enrichment, shown on NVD. The Hacker News cites 8.0. The KEV entry calls it improper authorization but lists CWE-693. The CVE record's affected field says "Android kernel", while the description says cellular modem.

Do you really need to act?#

For managed Pixel fleets, yes, this week. Three things push it up: the bug is in the modem, it needs no click, and Google has seen real use. "Proximal/adjacent" means the attacker has to be near the phone or on an adjacent network, not anywhere on the internet. That fits the profile of a targeted operation against chosen people, not mass exploitation. Most employees are unlikely targets. But you cannot easily tell who is one, and the fix is a routine update that has been out for five weeks. Patch everyone, and start with people whose phones are worth an exploit: executives, admins with production access, legal, and staff who travel.

If your organization has no Pixels, there is nothing to do for this CVE. Pixel phones already on 2026-09-05 or later, including the October update, are covered.

What to do now#

1. Export the security patch level for every Pixel from your MDM. On a single device, run adb shell getprop ro.build.version.security_patch and expect 2026-09-05 or later.
2. Add a compliance rule that blocks email, VPN and SSO access for Pixels below 2026-09-05.
3. Push or prompt the system update on non-compliant devices. Follow up by hand with high-risk users.
4. Replace any Pixel 5a or older still in use. It will never get this fix.
5. For BYOD Pixels, tell owners why the minimum patch level matters, so blocked access is not a surprise.

How to tell if you were hit#

Hard to say, and Google has not helped. As of October 21, 2026, it has published no indicators, payload names or attacker details. Modem-level exploitation leaves little that an MDM or an on-device app can see. In practice:

• Any Pixel below 2026-09-05 during August and September was exposed. Most were almost certainly not targeted.
• If a high-risk user's phone was unpatched and showed unexplained reboots, overheating, battery drain or data use, hand it to a mobile forensics specialist. Do not just update it and move on, because updating can destroy evidence.

Timeline#

• Jul 2, 2026 — Google's device CNA reserves CVE-2026-58704.
• Sep 15, 2026 — Google publishes the September Pixel bulletin (patch level 2026-09-05) with the limited, targeted exploitation note.
• Sep 16, 2026 — CISA adds the CVE to KEV.
• Sep 19, 2026 — CISA's remediation deadline for federal agencies.
• Oct 7, 2026 — The CVE record's CISA enrichment, which carries the 8.8 score, is last updated.

Vulnerability records

• CVE-2026-58704 · KEV 2026-09-16 · In Cellular Modem, there is a possible permission bypass due to a logic error in the code.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Android — Pixel Update Bulletin, September 2026 source.android.com
2. CVE record — CVE-2026-58704 cve.org
3. NVD — CVE-2026-58704 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-58704 cisa.gov
5. Google — Learn when you'll get software updates on Google Pixel phones support.google.com
6. 9to5Google — Google confirms Pixel phones were exploited in 'targeted' attack related to modem 9to5google.com

Coverage and analysis

1. SecurityWeek — Pixel Modem Zero-Day Exploited in Targeted Attacks securityweek.com
2. The Hacker News — Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation thehackernews.com