CVE-2026-58704: Google Pixel

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Yes, if you run Google Pixel. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2026-09-16, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2026-09-19; treat that as the outer limit, not the target.
EPSS 0.6%, percentile 48: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 48% of all scored CVEs (low). EPSS is a probability, not a verdict.
Editorial verdict: Patch this week. Google Pixel Modem CVE-2026-58704: Exploited Zero-Day — A targeted, no-interaction modem bug on Pixel phones with a fix already out: make 2026-09-05 the minimum patch level for every managed Pixel this week, and sooner for high-risk users.

What it is

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CISA’s summary

Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.

Weakness type: CWE-693, CWE-285.

Product: Google Pixel · Assigned by: Google_Devices · Published: 2026-09-15

Affected and fixed versions

Vendor	Product	Affected versions (per CVE record)
Google	Android	Android kernel

Severity scores

Scored by	CVSS	Score	Vector
CISA-ADP	3.1	8.8 High	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Attack vector: adjacent network only
Attack complexity: low
Privileges required: none (no login)
User interaction: none
Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: added 2026-09-16; federal due date 2026-09-19. Known ransomware use: Unknown.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA SSVC assessment: exploitation active, automatable no, technical impact total.
FIRST EPSS (model of 2026-10-21): 0.59% probability of exploitation activity in the next 30 days; percentile 48.

Timeline

2026-09-15 — CVE record published by Google_Devices
2026-09-15 — erroneo.us brief: Google Pixel Modem CVE-2026-58704: Exploited Zero-Day
2026-09-16 — Added to CISA’s Known Exploited Vulnerabilities catalog
2026-09-19 — CISA remediation deadline for US federal agencies
2026-10-07 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.