Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

Actively Exploited Pixel Modem Flaw Bypasses Permission Checks

Part of the CVE-2026-58704 story · since 16 Sep

Quiet for 3 weekslast report 9 Oct8 articles6 outlets
16 Sep · SecurityOnline first10 Oct18 OctNowThis article4th of 8
  • Wed 16 Sep, 07:57 UTC. SecurityOnline, first report. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 11:22 UTC. Malwarebytes, its first report on the story. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 13:40 UTC. SecurityWeek, its first report on the story. Google Patches Pixel Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:01 UTC. CISA, its first report on the story. Actively Exploited Pixel Modem Flaw Bypasses Permission Checks. Cites a CVE in CISA KEV. This article, 4th of 8.
  • Wed 16 Sep, 14:16 UTC. Security Affairs, its first report on the story. Google Fixes Exploited Pixel Modem Flaw in September Update. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 16:01 UTC. CISA. CISA Warns of Active Exploitation in Google Pixel Vulnerability. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 10:20 UTC. The Hacker News, its first report on the story. Hackers Earn $562,500 for Three Remote Exploits on Pixel 10. Cites a CVE in CISA KEV.

CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities (KEV) catalogue on 16 September 2026. The vulnerability affects Google Pixel devices and is an improper authorisation flaw in the cellular modem that may allow attackers to bypass permission checks and escalate privileges.

The flaw results from a logic error in the modem’s authorisation controls. An attacker could exploit it to circumvent permission checks and gain higher privileges. NVD assigns the vulnerability a CVSS score of 8.0, rated High. Patch status is currently unknown, and no patch or advisory is listed in the supplied data.

KEV inclusion confirms that attackers are actively exploiting the vulnerability. Use in ransomware campaigns is unknown. CISA set 19 September 2026 as the remediation deadline for affected federal agencies.

CISA requires organisations to apply mitigations in accordance with vendor instructions, BOD 26-04 guidance on prioritising security updates based on risk, and its Forensics Triage Requirements. FCEB agencies are directly affected by this requirement. Stakeholders must assess each asset’s internet exposure and follow applicable BOD 26-04 patching guidance, or discontinue use of the product if mitigations are unavailable. All organisations should review their exposure to Google Pixel devices.

See the NVD entry and CISA KEV catalogue for full details: https://nvd.nist.gov/vuln/detail/CVE-2026-58704.

How the story developed

All 8 articles
Quiet for 3 weekslast report 9 Oct8 articles6 outlets

8 articles from 6 outlets since 16 Sep. Quiet since 9 Oct. This was the 4th report, 6 hours after the first.

Now16 Sep179 OctFirst reportSecurityOnline · 16 Sep, 07:57This article4th of 8 · day 0
  • Wed 16 Sep, 07:57 UTC. SecurityOnline, first report. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 11:22 UTC. Malwarebytes, its first report on the story. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 13:40 UTC. SecurityWeek, its first report on the story. Google Patches Pixel Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 14:01 UTC. CISA, its first report on the story. Actively Exploited Pixel Modem Flaw Bypasses Permission Checks. Cites a CVE in CISA KEV. This article, 4th of 8.
  • Wed 16 Sep, 14:16 UTC. Security Affairs, its first report on the story. Google Fixes Exploited Pixel Modem Flaw in September Update. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 16:01 UTC. CISA. CISA Warns of Active Exploitation in Google Pixel Vulnerability. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 10:20 UTC. The Hacker News, its first report on the story. Hackers Earn $562,500 for Three Remote Exploits on Pixel 10. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Wed 16 SepDay 06
    1. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks07:57 · SecurityOnline · First report · Known exploited CVE
    2. Google Patches Pixel Modem Flaw Exploited in Targeted Attacks11:22 · Malwarebytes · Known exploited CVE
    3. Actively Exploited Pixel Modem Flaw Bypasses Permission Checks14:01 · CISA · official · CISA alert · Known exploited CVE · This article, 4th of 8
    Show 3 more from 16 Sep
    1. Google Patches Pixel Zero Day Exploited in Targeted Attacks13:40 · SecurityWeek · Known exploited CVE
    2. Google Fixes Exploited Pixel Modem Flaw in September Update14:16 · Security Affairs · Known exploited CVE
    3. CISA Warns of Active Exploitation in Google Pixel Vulnerability16:01 · CISA · official · Known exploited CVE
  2. Thu 17 SepDay 11
    1. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws10:42 · Security Affairs · Known exploited CVE

  3. Quiet for 3 weeks

    Fri 9 OctDay 231
    1. Hackers Earn $562,500 for Three Remote Exploits on Pixel 1010:20 · The Hacker News · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in