Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-58704

Published 2026-09-15

Updated 17 days ago

Vendor/s

Google

Product/s

Pixel

Version/s

\-

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

8.8

/ 10

High

Severity Details

Base score

8.8 High

Attack vector

Adjacent\_network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-58704 is a high-severity (8.8) privilege escalation flaw in Google Pixel cellular modems. CISA warns of active exploitation.

## Why this matters

"CVE-2026-58704 is a critical vulnerability in the cellular modem component of Google Pixel devices. With a CVSS score of 8.8, it allows for remote escalation of privilege without user interaction. Because this is listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, it represents a real-world threat that is actively being leveraged by attackers. The 'Adjacent Network' attack vector means an attacker in physical proximity—such as on the same Wi-Fi network or using localized cellular spoofing—could bypass security permissions. This poses a significant risk to data confidentiality and system integrity for mobile users in public or shared spaces."

## CPE

Google

| Product | Version Start | Version End (excl.) | Status     |
| ------- | ------------- | ------------------- | ---------- |
| android | -             | -                   | vulnerable |

## Related weakness (CWE)

CWE-285, CWE-693

## Remediation plan

1

### Apply official patches

Install the September 2026 (or later) Google Pixel security update immediately to address the logic error in the modem firmware.

2

### Update affected systems

Ensure all Pixel devices running affected Android versions are updated to the latest security patch level provided in the Android Security Bulletin.

3

### Restrict access

Minimize exposure by avoiding untrusted wireless networks and disabling unnecessary cellular features in high-risk environments until patches are applied.

4

### Monitor for exploitation

Review device logs for unusual modem crashes or unauthorized privilege changes, and follow CISA's Forensics Triage Requirements for potentially compromised assets.

## Detection Guidance

"Detection involves monitoring for anomalous cellular modem behavior, such as unexpected resets or unauthorized attempts to access system-level permissions. Security teams should inspect Android system logs (logcat) for errors related to the RIL (Radio Interface Layer) or modem firmware. Additionally, look for unusual traffic patterns on adjacent networks or unauthorized proximal connections that coincide with privilege escalation events on mobile endpoints."

## References

[https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 Vendor Advisory ](https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-58704 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)