CVE-2026-58704: Google Pixel Improper Authorization Flaw Added to CISA KEV

TL;DR

CISA added CVE-2026-58704, an improper authorization vulnerability in the Google Pixel cellular modem, to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-16, with a federal remediation due date of 2026-09-19. If your fleet includes Pixel devices, treat this as a same-week action: inventory affected handsets, apply Google's September 2026 Pixel security bulletin updates, and confirm modem firmware versions before closing the ticket.

What is this vulnerability?

• CVE ID: CVE-2026-58704
• Vendor / product: Google / Pixel
• Vulnerability name: Google Pixel Improper Authorization Vulnerability
• Weakness class: CWE-693 (Protection Mechanism Failure) — reported as a logic error in the cellular modem that may allow an attacker to bypass permission checks and escalate privileges.
• CISA KEV status: Yes — added 2026-09-16
• CISA due date: 2026-09-19
• Known ransomware use: Unknown per CISA's KEV entry

The flaw sits in the Pixel cellular modem and is characterized as an improper authorization condition. In practical terms, a logic error in permission enforcement could let an attacker escalate privileges on the device. Because the modem is a baseband component, exposure is not limited to traditional "internet-facing" web services — any Pixel handset in scope of the affected build is a candidate for review.

CISA's required action is to apply mitigations in accordance with vendor instructions, consistent with BOD 26-04 Prioritizing Security Updates Based on Risk and the associated Forensics Triage Requirements. Where mitigations are unavailable, BOD 26-04 guidance for cloud services applies, up to and including discontinuing use of the product. Asset owners remain responsible for evaluating each asset's exposure and adhering to BOD 26-04 patching timelines.

KEV vs CVSS vs EPSS

Signal	What it measures	How to use it for this CVE
CISA KEV	Confirmed in-the-wild exploitation, with a binding remediation due date for federal agencies	Authoritative trigger here. CVE-2026-58704 is listed with a 2026-09-19 due date — treat that as your internal SLA anchor even outside the federal scope.
CVSS	Technical severity of the vulnerability in isolation	Not provided in the source intel for this CVE. Do not assume a score; rely on KEV status and vendor guidance for prioritization.
EPSS	Probability the CVE will be exploited in the next 30 days	Not provided in the source intel. KEV listing already supersedes EPSS as the prioritization signal for this CVE.

Bottom line: KEV membership is the decisive signal. When a CVE is in KEV, exploitability is no longer hypothetical, and the due date — not a severity score — drives the work queue.

Step-by-step remediation

1. Inventory. Enumerate Google Pixel devices across managed and unmanaged estates, including BYOD handsets with corporate data access, field devices, and executive phones. Capture model, build number, and modem firmware version.
2. Patch or mitigate. Apply the updates in Google's September 2026 Pixel security bulletin (see Related resources). Follow vendor instructions exactly; where a device cannot be updated, apply the vendor's documented mitigations or remove it from sensitive access per BOD 26-04 guidance for unavailable mitigations.
3. Verify. Confirm the update landed by re-checking build and modem firmware versions against the vendor bulletin. Do not rely on "update available" notifications alone — verify on-device state.
4. Triage forensics. Per CISA's Forensics Triage Requirements, preserve relevant logs and device telemetry for any Pixel device that may have been exposed prior to patching.
5. Close the ticket. Document the patch date, verification evidence, and any residual risk accepted. Align closure records with your BOD 26-04 reporting obligations if you are a federal or regulated entity.

FAQ

Is CVE-2026-58704 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-16.

What is the CISA due date? 2026-09-19. Federal agencies are required to remediate by that date; other organizations should treat it as a strong internal SLA target.

Is this vulnerability internet-facing? It affects the Pixel cellular modem, so exposure is tied to the device rather than a public web service. CISA explicitly notes that stakeholders are responsible for evaluating each asset's internet exposure and applying BOD 26-04 patching guidelines accordingly.

Is there a ransomware tie? CISA lists known ransomware use as Unknown for this CVE. Absence of a confirmed ransomware link does not lower priority — KEV listing alone justifies urgent remediation.

What is the weakness type? CWE-693, Protection Mechanism Failure, described as an improper authorization logic error in the modem that may allow permission-check bypass and privilege escalation.

What if I can't patch immediately? Follow vendor mitigations where available. If mitigations are unavailable, BOD 26-04 guidance for cloud services applies, including discontinuing use of the product where necessary.

Related resources

• Google Pixel Security Bulletin — September 2026
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD — CVE-2026-58704
• CISA Known Exploited Vulnerabilities Catalog