Google Pixel CVE-2026-58704: Modem Improper Auth

Yesterday’s newest KEV entry is sitting in people’s pockets. CISA added an actively exploited Google Pixel improper-authorization flaw in the cellular modem. The federal due date is September 19, 2026.

If executives, admins, or field staff carry corporate or BYOD Pixels into email, VPN, and MFA, this is a fleet compliance event, not a consumer footnote.

What happened

On September 16, 2026, CISA announced one new Known Exploited Vulnerability: CVE-2026-58704, described as a Google Pixel improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges on affected devices.

CISA’s remediation due date is September 19, 2026. Forensic triage is required per BOD 26-04. The agency points defenders at Google’s September Pixel security bulletin for the fixed security patch level.

Why it matters

Mobile authorization bypasses rarely stay “just phone problems.” They sit under the apps that hold SSO sessions, authenticator tokens, corporate mail, and VPN profiles.

KEV inclusion means exploitation evidence cleared CISA’s bar. Waiting for a perfect CVSS write-up is how fleets miss a three-day federal clock.

What to do first

• Inventory managed and BYOD Pixel devices in MDM. Require the Android security patch level from Google’s September Pixel bulletin — OS version alone is not proof.
• Mark stale-patch Pixels noncompliant; quarantine from email, VPN, and SSO until remediated.
• Disable developer options / ADB for standard users; block unknown sources; keep package verification on.
• For high-value users on noncompliant devices during the exposure window: revoke sessions and refresh tokens; rotate sensitive credentials if control-weakening or sideload signals appear.
• Keep hunting ~14 days post-patch — persistence and stolen tokens can outlive the modem fix.

Details

• CVE: CVE-2026-58704
• Product: Google Pixel (cellular modem improper authorization)
• KEV added: 2026-09-16 · Due: 2026-09-19
• Forensic triage (BOD 26-04): Yes
• Ransomware use: Unknown (per KEV)
• Fix: Google September 2026 Pixel security update — verify MDM-reported patch level

Hunt / verify

• MDM report: Pixel model + ro.build.version.security_patch ≥ bulletin fixed level.
• Flag unknown-source installs, package-verifier off, developer options / ADB enabled on production devices.
• Correlate admin-workstation adb/fastboot use against ticketed mobile-engineering exceptions.

Sources

• CISA: Adds one KEV — CVE-2026-58704 (Sep 16, 2026)
• CISA KEV Catalog — CVE-2026-58704
• Google Pixel security bulletin (September 2026)
• Security Arsenal: Pixel KEV patch and compliance guide

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].