CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities Catalog on September 16, 2026, citing evidence of active exploitation. Google had disclosed the day before that the high-severity flaw in the Pixel cellular modem showed indications of limited, targeted exploitation. For Pixel owners, the immediate action is straightforward: install the September 2026 security update and verify a patch level of 2026-09-05 or later on a supported device.

What happened on September 16, 2026

Google’s September Pixel security bulletin, published on September 15, described CVE-2026-58704 as an elevation-of-privilege vulnerability in the modem and said it may have been exploited in limited, targeted attacks. On September 16, CISA added the CVE to its catalog of known exploited vulnerabilities, using evidence of active exploitation as the basis for the entry.

CISA’s catalog sets September 19, 2026 as the remediation due date and flags forensic triage for the entry. The federal deadline applies to U.S. Federal Civilian Executive Branch agencies; CISA presents prioritizing remediation through risk-based vulnerability management as broader guidance for organizations.

What CVE-2026-58704 does

The vulnerability involves improper authorization in the Pixel cellular modem. The technical description identifies a possible permission bypass caused by a logic error, which could allow privilege escalation from a nearby or adjacent network.

The CISA-ADP CVSS 3.1 rating is 8.8 High. Its documented attack conditions are:

  • Adjacent network access: the attacker must be near the relevant network path rather than reaching the device from anywhere on the internet.
  • Low complexity: the scoring system rates the attack as requiring low complexity.
  • No privileges required: the attacker does not need an account or existing permissions on the device.
  • No user interaction: the vulnerability can be exploited without a tap, link, file opening or other action from the owner.

That last point matters in practical terms. A suspicious message or an unexpected tap is not a reliable test for this vulnerability, because the documented attack conditions do not require user interaction.

Why CISA’s catalog entry raises the urgency

Google’s initial wording was cautious: it reported indications of limited, targeted exploitation. CISA’s later catalog action recorded the vulnerability as actively exploited. Those are different stages of the same disclosure: Google described the exploitation signal in its bulletin, while CISA used active-exploitation evidence when adding the CVE to its catalog.

The catalog entry identifies Google Pixel and the cellular modem as the affected product and component. Google’s bulletin groups the issue under the Pixel modem rather than naming individual device models, so owners should treat the available September security update as the relevant protection for supported Pixel devices instead of relying on a model-by-model assumption.

The patch Pixel owners should verify

Google says the September 2026 Pixel security update addresses the bulletin’s listed issues at security patch level 2026-09-05. Install the update offered for your supported Pixel and check that the device reports that level or a later one.

If you suspect that an account or device was exposed before it received the patch, rotate sensitive credentials and monitor accounts for unauthorized activity. The technical details released for CVE-2026-58704 do not identify the victims, attacker or exploitation method, so there is no narrower incident check available to ordinary owners beyond updating and watching for account activity.