Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.
NVD: In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Hunt kernel audit logs for unexpected privilege transitions from the Pixel Cellular Modem subsystem and monitor dmesg for unusual baseband init sequences or modem firmware loads indicating permission-bypass exploitation.
Research details
ComponentCellular Modem permission-check logic
PreconditionsAttacker requires adjacent network access to the target Pixel device (same cellular broadcast area or layer-2 adjacency); the target must be running a vulnerable Pixel firmware version; no user interaction or additional privileges are required. CVSS AV:A confirms adjacent-network attack vector with low complexity and low privileges required. agent
Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 8.0). The vulnerability is in the cellular modem firmware at a low abstraction layer; exploitation likely requires specialized radio-access tooling or knowledge of modem internals. No public PoC exists; the vendor notes limited targeted exploitation is underway.
SummaryCVE-2026-58704 is an elevation-of-privilege vulnerability in the Pixel Cellular Modem caused by a logic error that bypasses permission checks. A nearby attacker with adjacent-network access can escalate privileges without user interaction. Google's September 2026 Pixel bulletin notes indicators of limited targeted exploitation. The fix is in the 2026-09-05 patch level.
Tia coverage
First reported2026-09-04
First exploit report2026-09-16
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.