Yesterday’s newest KEV entry is sitting in people’s pockets. CISA added an actively exploited Google Pixel improper-authorization flaw in the cellular modem — with a federal due date of September 19, 2026.
If executives, admins, or field staff carry corporate or BYOD Pixels into email, VPN, and MFA, this is a fleet compliance event, not a consumer footnote.
What happened
On September 16, 2026, CISA announced one new Known Exploited Vulnerability: CVE-2026-58704, described as a Google Pixel improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges on affected devices.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
CISA’s remediation due date is September 19, 2026. Forensic triage is required per BOD 26-04. The agency points defenders at Google’s September Pixel security bulletin for the fixed security patch level.
Why it matters
Mobile authorization bypasses rarely stay “just phone problems.” They sit under the apps that hold SSO sessions, authenticator tokens, corporate mail, and VPN profiles.
KEV inclusion means exploitation evidence cleared CISA’s bar. Waiting for a perfect CVSS write-up is how fleets miss a three-day federal clock.
What to do first
- Inventory managed and BYOD Pixel devices in MDM. Require the Android security patch level from Google’s September Pixel bulletin — OS version alone is not proof.
- Mark stale-patch Pixels noncompliant; quarantine from email, VPN, and SSO until remediated.
- Disable developer options / ADB for standard users; block unknown sources; keep package verification on.
- For high-value users on noncompliant devices during the exposure window: revoke sessions and refresh tokens; rotate sensitive credentials if control-weakening or sideload signals appear.
- Keep hunting ~14 days post-patch — persistence and stolen tokens can outlive the modem fix.
Details
- CVE: CVE-2026-58704
- Product: Google Pixel (cellular modem improper authorization)
- KEV added: 2026-09-16 · Due: 2026-09-19
- Forensic triage (BOD 26-04): Yes
- Ransomware use: Unknown (per KEV)
- Fix: Google September 2026 Pixel security update — verify MDM-reported patch level
Hunt / verify
- MDM report: Pixel model +
ro.build.version.security_patch≥ bulletin fixed level. - Flag unknown-source installs, package-verifier off, developer options / ADB enabled on production devices.
- Correlate admin-workstation
adb/fastbootuse against ticketed mobile-engineering exceptions.
Sources
- CISA: Adds one KEV — CVE-2026-58704 (Sep 16, 2026)
- CISA KEV Catalog — CVE-2026-58704
- Google Pixel security bulletin (September 2026)
- Security Arsenal: Pixel KEV patch and compliance guide
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
