Skip to content

Google Pixel cellular-modem privilege escalation CVE-2026-58704: KEV-listed with Google's own "limited, targeted exploitation" note (Sep 16, 2026)

Summary

On September 16, 2026, CISA added CVE-2026-58704 — an improper authorization vulnerability in the cellular modem of Google Pixel devices — to the KEV catalog (catalog 2026.09.16, 1,711 entries at capture; the batch later grew to three additions / 1,713 entries the same day with Cisco ISE CVE-2026-76460 and Acronis Backup CVE-2026-87886 — Pixel was the first-listed). CISA's description: "a logic error may allow an attacker to bypass permission checks and escalate privileges" (CWE-693). The durable signal is not CISA's wording but Google's: the September 15, 2026 Pixel Update Bulletin states outright that "there are indications that CVE-2026-58704 may be under limited, targeted exploitation" — vendor-confirmed exploitation language on a baseband/modem bug, three days before CISA's listing. BOD 26-04 due date is 2026-09-19 with Forensics Triage required; the fix is the 2026-09-05 security patch level (all supported Pixel devices move to it). Modem EoP is a rare KEV animal: persistence below the OS, invisible to endpoint agents and OS reinstall, reachable from the radio path.

Tags

The flaw and the listing

  • CVE-2026-58704 — Google Pixel, Modem subcomponent (bug A-484011314), type EoP, severity High in Google's table; CISA categorizes it as improper authorization (CWE-693) in the cellular modem: a logic error that bypasses permission checks and escalates privileges inside the modem firmware/stack.
  • KEV row: added 2026-09-16, due 2026-09-19 (a compressed 3-day window), Forensics Triage yes, known ransomware use Unknown, no actor named in KEV.
  • Exploitation status: Google's Pixel Update Bulletin (published September 15, 2026) carries the note "There are indications that CVE-2026-58704 may be under limited, targeted exploitation." This is the same "limited, targeted exploitation" phrasing Google historically reserves for confirmed spyware/zero-click-class bugs. CISA listed it the next day.
  • Fix: security patch level 2026-09-05 or later addresses the bulletin; all supported Google devices receive the update; firmware images are on the Google developer site. The bulletin is separate from (and additional to) the September 2026 Android Security Bulletin.

Why a modem EoP matters differently

  1. Persistence below the operating system. A compromised baseband lives in the cellular modem's own processor and firmware. Factory resets, OS reinstats, and image reflashes that don't reprogram the modem partition may not evict it; host EDR has no visibility into modem execution.
  2. Attack surface from the radio. Modem bugs are reachable through the cellular path (network-side or neighbor-cell attack), not only via installed apps — the same reason baseband CVEs attract intelligence-grade interest.
  3. "Targeted" wording implies selection. Google's phrasing suggests specific victims, not mass crime-kit use. On Pixel hardware that skews toward journalists, activists, executives — the classic commercial-spyware buyer profile. No vendor or government has named an actor or campaign; treat attribution as open.
  4. Sibling criticals in the same bulletin. The September 2026 Pixel bulletin also fixes multiple Critical RCE entries in modem-adjacent components (CVE-2026-56967 Modem RCE, CVE-2026-55318 IMS, CVE-2026-55343 libpixelimsmedia, CVE-2026-56920 VPU, CVE-2026-58683 Telephone, CVE-2026-58710 BigOcean) and bootloader EoP (CVE-2026-0179) — a heavy radio-stack month even setting the KEV item aside.

Actions

  1. Federal BOD 26-04 scope: patch/verify all Pixel fleet devices at 2026-09-05 SPL by 2026-09-19; verify patch level through MDM/Android Enterprise rather than user self-report.
  2. Confirm the update actually applied to the modem: Pixel updates normally reprogram baseband firmware; after updating, reboot and re-check patch level; where feasible, re-provision managed devices that cannot attest the level.
  3. High-risk-user guidance: assume any device that could not receive the September update during the exposure window is at elevated risk; least-risk replacement is the practical control for targeted mobile compromise (mirror Android's own Project Zero guidance pattern).
  4. Detection realism: there is no host-side indicator to hunt for a modem compromise; defense here is update enforcement + exposure management (disable 2G/legacy fallback where supported, keep devices on trusted networks), not telemetry.
  5. Watch for scope creep: if the bug class proves shared with non-Pixel chipsets, expect further KEV rows for other Android vendors; monitor the October Android + Pixel bulletins and any Google/CISA elaboration.

Sources