Affected Systems
Google Pixel devices with cellular modem component. All devices with security patch level prior to 2026-09-05. CVE-2026-58704 is a logic error enabling remote (proximal/adjacent) privilege escalation without user interaction.
Exploitation Status
Active exploitation confirmed. Google reports limited, targeted exploitation in the wild. CISA added CVE-2026-58704 to KEV catalog on September 16, 2026. Zero-click attack vector—no user interaction required. Threat actor identity and attack details not disclosed.
Business Impact
High-severity privilege escalation (CVSS 8.0) in cellular modem allows attackers within proximal/adjacent network range to bypass permissions silently. Zero-click exploitation means no phishing or social engineering required. Targeted nature suggests APT or surveillance activity. Federal agencies face September 19, 2026 remediation deadline per CISA KEV. Organizations with Pixel device fleets should prioritize patching, especially for executives and high-value targets.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update all Google Pixel devices to security patch level 2026-09-05 or later via Settings > Security & privacy
- Prioritize patching for Pixel devices used by executives, government personnel, or users handling sensitive data
- Review mobile device management (MDM) logs for Pixel devices to identify unpatched endpoints and enforce update policies
- Monitor for anomalous cellular modem activity or unexpected privilege escalations on Pixel devices if patching is delayed
- Federal agencies must apply fixes by September 19, 2026 per CISA KEV directive BOD 22-01