CISA encourages organizations to apply vendor-provided mitigations and prioritize remediation of KEV Catalog vulnerabilities. Federal Civilian Executive Branch agencies must prioritize rapid remediation of CVE-2026-58704 on publicly exposed assets per BOD 26-04 and assess whether systems were compromised before patch application. All organizations should adopt risk-based vulnerability management practices.
Google has disclosed and patched a high-severity privilege escalation vulnerability in the Pixel Cellular Modem, tracked as CVE-2026-58704 (CVSS 8.0). The flaw, a permission bypass due to a logic error, has been exploited in the wild in limited, targeted attacks. Users are urged to apply the September 2026 security update immediately.
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-58704, an improper authorization vulnerability affecting Google Pixel devices, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition is based on evidence of active exploitation in the wild. CISA's Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of this vulnerability on publicly exposed assets, with specific requirements for pre-patch compromise assessment.
