Google Pixel Cellular Modem Privilege Escalation Vulnerability (CVE-2026-58704) Security Advisory

Affected Vendors

Google, Android

Affected Components

Pixel, Cellular Modem Firmware

Published Date

2026-09-15

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Google Pixel devices and Android hardware utilizing specific cellular modem chipsets.

Impact

Remote (proximal/adjacent) attackers can bypass permissions to escalate privileges without user interaction, leading to full modem compromise.

Mitigation

Immediately apply the September 2026 or later Android security patches (2026-09-01).

Affected Products & Version Scope

Google Pixel devices and Android smartphones with security patch levels prior to 2026-09-01.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Immediate Firmware Update

Users must update their devices to the latest available firmware version.

Path: Settings > System > System Update > Check for updates.
Target Level: Ensure the security patch level is 2026-09-01 or newer.

2. Fleet Management (MDM/ADB)

Enterprise admins should enforce the patch level via MDM policies or verify manually using ADB:

bash

adb shell getprop ro.build.version.security_patch

3. Network Security Best Practices

Until patched, minimize exposure to untrusted proximal networks and monitor for anomalous cellular behavior in high-risk environments.

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

This vulnerability is actively exploited in the wild. Apply the 2026-09-01 security update immediately to mitigate risk.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

CVE-2026-58704 is a critical logic error within the cellular modem firmware that leads to improper authorization (CWE-285). An attacker within radio proximity can exploit this flaw by sending malformed packets to the modem, bypassing internal protection mechanisms (CWE-693) without any prerequisite execution privileges or user interaction (Zero-click). Given its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog and an EPSS score of 0.94, this vulnerability represents a significant threat to mobile infrastructure security, potentially allowing for unauthorized access to sensitive communication data.

Official Vendor Advisories & References

NVD Original English Description

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01

Source: dsap-vuln-management@google.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: