Google Pixel CVE-2026-58704 exploited in the wild
Executive summary
CISA lists CVE-2026-58704, a vulnerability in Google Pixel, in the Known Exploited Vulnerabilities catalog (added 2026-09-16, due 2026-09-19), and NVD records a CVSS of 8.8. This report summarizes public CTI only.
Technical analysis
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CPE: CWE-285, CWE-693. CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
IOCs
No public IOC is available.
CVEs and affected products
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
ATT&CK mapping
Exploit Public-Facing Application
Tactic: Initial Access
Detection content
Sigma rules, YARA rules, Splunk SPL, and KQL detection logic.
Threat hunting
Hypothesis-driven hunt procedures and telemetry checklist.
Remediation
Containment actions, patching notes, and credential steps.
Historical relationships
No published historical relationship is available.
Timeline and change history
Confidence and caveats
0.9
⚠️ This report describes public CTI and does not assess any specific organization's exposure.
⚠️ Detection queries are templates and require local validation.
⚠️ Exploitation status reflects the public CISA KEV catalog record.
📄
Intelligence Sources & Advisory Feeds
DFIR investigations, vendor research, advisory feeds & verified claims
10 references
▼
Evidence consists of the NVD record, the CISA KEV catalog entry, the FIRST EPSS model output, and indexed source documents that reference this CVE.
NVD entry for CVE-2026-58704: In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. The record carries CVSS 8.8 (3.1) vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, weaknesses CWE-285, CWE-693.
CISA added CVE-2026-58704 to the Known Exploited Vulnerabilities catalog on 2026-09-16 with a required due date of 2026-09-19, recording the vulnerability as exploited in the wild and affecting vendor Google, product Pixel. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
FIRST EPSS models an exploitation probability of 0.00308 (percentile 0.20988) for CVE-2026-58704.
Source soc-prime-detection-news published 2026-09-17 at https://socprime.com/blog/cve-2026-58704-google-pixel-modem-zero-day/ references CVE-2026-58704 affecting Google Pixel.
Source securityweek published 2026-09-16 at https://www.securityweek.com/pixel-modem-zero-day-exploited-in-targeted-attacks/ references CVE-2026-58704 affecting Google Pixel.
Source cisa-cybersecurity-advisories published 2026-09-16 at https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-one-known-exploited-vulnerability-catalog references CVE-2026-58704 affecting Google Pixel.
Source the-hacker-news published 2026-09-16 at https://thehackernews.com/2026/09/google-patches-pixel-modem-flaw-amid.html references CVE-2026-58704 affecting Google Pixel.
Source cisa-known-exploited-vulnerabilities published 2026-09-16 at https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json#CVE-2026-58704 references CVE-2026-58704 affecting Google Pixel.
Source nist-national-vulnerability-database-nvd published 2026-09-15 at https://nvd.nist.gov/vuln/detail/CVE-2026-58704 references CVE-2026-58704 affecting Google Pixel.
Source canadian-centre-for-cyber-security-alerts published undated at https://cyber.gc.ca/en/alerts-advisories/android-security-advisory-september-2026-monthly-rollup-av26-920 references CVE-2026-58704 affecting Google Pixel.