CISA KEV: Actively Exploited Improper Authorization Flaw in Google Pixel Cellular Modem (CVE-2026-58704)

What happened

Google has disclosed an improper authorization vulnerability affecting the cellular modem component on Pixel devices, tracked as CVE-2026-58704. According to the advisory, a logic error in the modem's authorization checks may allow an attacker to bypass permission checks and escalate privileges. This flaw has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating it is being actively exploited in the wild. No CVSS score has been published for this entry, and there is currently no confirmed link to ransomware activity.

Why it matters for defenders

Because the vulnerability resides in the cellular modem, it sits below the Android application layer and touches baseband processing — a component that is historically difficult to instrument and monitor, and where a successful privilege escalation could undermine assumptions about OS-level isolation. Any organization with a fleet of Google Pixel devices, particularly those used for sensitive communications, MDM-managed corporate deployments, or as secure/hardened endpoints, should treat this as relevant. Its inclusion in CISA KEV means US federal agencies are subject to mandated remediation timelines, and it should be treated as a priority patch item more broadly given the active-exploitation signal.

What defenders should watch for or do now

• Confirm which Pixel models and firmware/security-patch levels are deployed in your fleet and prioritize the September 2026 Pixel security update.
• Check MDM/UEM dashboards for devices that have not applied the latest patch level and force updates where policy allows.
• Watch for anomalous modem or baseband behavior indicators where available (crash logs, unexpected radio state changes, unusual privilege elevation on-device) via your EMM/MDM telemetry.
• Review device enrollment and privileged app entitlements on Pixel devices, since privilege escalation at the modem level could be chained with other issues to gain broader device control.
• Track vendor guidance closely — modem-level authorization bypass details are often initially sparse, with more technical detail following after patch adoption improves.

Developing intel

This is a same-day KEV addition and details are still emerging; there is no public proof-of-concept or exploitation methodology confirmed in the source at this time. Defenders should treat this summary as preliminary and consult the original Google Android/Pixel security bulletin for authoritative, updated guidance: https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01.