CVE-2026-58704 Sumo Logic CSE · Sumo

Detect Google Pixel Modem Improper Authorization (CVE-2026-58704) in Sumo Logic CSE

Detects exploitation indicators and vulnerable-device exposure for CVE-2026-58704, a KEV-listed improper authorization (CWE-693) flaw in the Google Pixel baseband/modem stack disclosed in the September 2026 Android/Pixel security bulletin. The weakness allows a protection mechanism to be bypassed so that operations requiring authorization are performed without it, enabling privilege escalation or unauthorized access to modem/telephony resources on affected Pixel devices. This detection surfaces Pixel devices whose reported security patch level predates the 2026-09-01 fix via MDM/UEM and endpoint telemetry, and hunts for anomalous modem crashes, unexpected radio interface manager (RILD) behavior, and post-exploitation privilege changes indicative of active exploitation.

MITRE ATT&CK

Tactic
Privilege Escalation Initial Access

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=mdm/device (Pixel OR Google)
| json field=_raw "model", "manufacturer", "security_patch_level", "device_name", "os_version" as model, manufacturer, patch, device, os nodrop
| where (model matches /(?i)pixel/ or manufacturer matches /(?i)google/)
| where patch < "2026-09-01"
| fields device, model, os, patch
| sort by patch asc
high severity medium confidence

Sumo Logic search flagging Pixel devices whose reported security patch level is below the 2026-09-01 fixed level for CVE-2026-58704.

Data Sources

MDM device inventory logs

Required Tables

mdm/device

False Positives & Tuning

  • Pending OTA installs reporting old patch level.
  • Intentionally unpatched test devices.
  • Stale inventory records after a device patched.

Other platforms for CVE-2026-58704

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Enumerate Pixel security patch level

    Expected signal: ADB shell command execution and a property read returning a date string such as 2026-08-01.

  2. Test 2Simulate RIL daemon crash

    Expected signal: A rild process crash/abort event and subsequent automatic restart recorded in logcat and endpoint telemetry.

  3. Test 3Privileged property change after modem event

    Expected signal: A rild crash immediately followed by a privileged setprop invocation on the same device within the correlation window.

Last updated: 2026-09-17 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the device model is a Google Pixel and pull its exact Android security patch level from MDM/UEM; anything older than 2026-09-01 is vulnerable to CVE-2026-58704.
  2. Correlate the flagged device against telephony/modem telemetry for the same window: look for repeated rild crashes, unexpected baseband resets, or abnormal SMS/RIL activity.
  3. Determine device ownership and sensitivity (executive, privileged admin, VIP) to prioritize response given the KEV/BOD-26-04 status.
  4. Check whether the device has a pending OTA and how long it has been non-compliant to distinguish an update lag from a suspicious hold-back.

Containment

  1. Push or force the September 2026 (2026-09-01) Pixel security update via MDM and require reboot; block noncompliant Pixels from accessing corporate resources with a conditional access policy.
  2. For devices showing exploitation indicators, quarantine via MDM (network isolation / selective wipe of corporate data) and revoke associated tokens and certificates.

Evidence Collection

  1. Capture the device MDM compliance record, security patch level history, and last check-in timestamps.
  2. Where supported, collect on-device bugreport/logcat, modem crash dumps (ramdump/tombstones), and RIL logs before any wipe or re-image.

Escalation Criteria

  • !Escalate to IR if a vulnerable Pixel shows correlated modem-crash-then-privilege-change telemetry, indicating active exploitation.
  • !Escalate to leadership/legal if an exploited device belongs to a high-risk user or handled sensitive data, given federal KEV/BOD-26-04 remediation obligations.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Modem/baseband tombstone and ramdump files under /data/tombstones and vendor crash logs.
  • >RIL/telephony logcat buffers and dropbox entries recording rild restarts.
  • >MDM security patch level history and compliance state transitions.

Tuning Guidance

Baseline the normal cadence of rild restarts during legitimate firmware updates and telephony service maintenance so those windows can be excluded. Maintain an allowlist of sanctioned rooted/developer test Pixels to suppress su/magisk false positives, and treat the patch-level inventory query as the authoritative exposure signal while the modem-crash correlation rules serve as higher-confidence exploitation indicators.

Hunting Queries

Trend the count of Pixel devices still below the 2026-09-01 patch level to track remediation progress against the CVE-2026-58704 KEV deadline.

Hunting — KQL
kql 
DeviceInfo | where Model has "Pixel" | extend PatchLevel = todatetime(AdditionalFields.SecurityPatchLevel) | where PatchLevel < datetime(2026-09-01) | summarize Devices=dcount(DeviceId) by bin(Timestamp, 1d)
Hunting — SPL
spl 
index=mdm (Pixel OR Google) | eval p=strptime(security_patch_level,"%Y-%m-%d"), f=strptime("2026-09-01","%Y-%m-%d") | where p<f | stats dc(device_name) as vulnerable_devices by model

Atomic Red Team Tests

Test 1 Enumerate Pixel security patch level
linux

Read the Android security patch level property from a Pixel device to determine exposure to CVE-2026-58704.

Command

bash 
adb shell getprop ro.build.version.security_patch

Cleanup

bash 
echo 'no cleanup required - read-only'

Expected Telemetry

ADB shell command execution and a property read returning a date string such as 2026-08-01.

Expected Detection

MDM inventory reflects a security patch level earlier than 2026-09-01, matching the vulnerable-device queries.

Test 2 Simulate RIL daemon crash
linux

Force a restart/crash of the radio interface layer daemon in a lab to generate the modem-crash telemetry the correlation rules key on.

Command

bash 
adb shell su 0 killall -SEGV rild

Cleanup

bash 
adb shell su 0 stop ril-daemon; adb shell su 0 start ril-daemon

Expected Telemetry

A rild process crash/abort event and subsequent automatic restart recorded in logcat and endpoint telemetry.

Expected Detection

Elastic EQL, Chronicle, and CrowdStrike modem-crash rules register the rild crash event on the host.

Test 3 Privileged property change after modem event
linux

Set a system property via a privileged command shortly after a simulated modem event to reproduce the crash-then-privilege-change exploitation sequence.

Command

bash 
adb shell su 0 killall -SEGV rild; sleep 2; adb shell su 0 setprop persist.sys.test.cve202658704 1

Cleanup

bash 
adb shell su 0 setprop persist.sys.test.cve202658704 ""

Expected Telemetry

A rild crash immediately followed by a privileged setprop invocation on the same device within the correlation window.

Expected Detection

The 10-minute sequence rules (Elastic EQL, Chronicle YARA-L, CrowdStrike CQL) fire on the correlated crash-then-privilege-change pattern.

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0001Initial Access

Related Techniques

T1068Exploitation for Privilege EscalationT1190Exploit Public-Facing Application

Same Tactic: Privilege Escalation

Popular Detections