CVE-2026-58704

Your phone has a cellular modem component that helps it connect to mobile networks. This vulnerability is like a “rules check” mistake: a nearby attacker can slip past permission checks and take control of security functions on the device without you doing anything.

Think of it as someone standing close enough to “pick the lock” on your phone’s internal security system—then they can access and change sensitive information and disrupt the device.

This matters if your small business uses Android phones with the Cellular Modem component—especially Pixel devices—because the flaw is in core phone connectivity hardware/software.

The risk is for attackers who can get physically close (proximal/adjacent). There is no need for the attacker to log in or trick you with a click, and exploitation has been reported (limited, targeted) and is reflected in CISA KEV; treat it as a real active risk where the device is accessible to someone nearby.

RED. This is actively exploited in limited, targeted attacks and it’s listed in CISA KEV, meaning it’s not just theoretical.

CISA remediation guidance requires action by 2026-09-19, so you should prioritize patching the affected Pixel/Android devices to the vendor fix immediately.

1. Identify affected devices

   • Inventory the Android phones used by your business, focusing on Pixel models.
   • Confirm current Android security patch level and build/version via your device management tool or device settings.

2. Determine whether you’re covered by the fix

   • Use the vendor remediation bulletin referenced for Pixel security (dated 2026-09-01) and confirm your device includes that updated security patch.
   • If your device is not at (or beyond) the bulletin’s fixed state, plan an update.

3. Patch to the vendor fix

   • Apply the vendor’s Android update that corresponds to the 2026-09-01 Pixel security bulletin.
   • Reboot the device after updating and re-check the security patch level to confirm it shows the updated level.

4. If patching is delayed

   • Because exploitation requires a nearby attacker and no user interaction, treat this as a physical access risk.
   • Tighten physical controls: limit who can access unattended devices, secure devices in locked areas, and avoid leaving phones where visitors or passersby can approach.

5. Verify and monitor after update

   • Check your mobile device management (MDM) logs for successful update compliance.
   • Watch for unusual behavior consistent with compromise (unexpected connectivity changes, security setting changes, or device management alerts), and respond according to your incident process.

6. CISA timing

   • CISA KEV due date for required remediation is 2026-09-19; aim to complete updates before that date.

Severity is high (CISA KEV listing and exploitation reports). The vulnerability is a permission-bypass logic error in the Android Cellular Modem (CWE-285 and CWE-693).

Mechanism/trigger: an attacker in close physical range (proximal/adjacent) can cause the modem component to bypass permission checks and escalate privileges, leading to full compromise of the device’s security controls. Exploitation does not require authentication and requires no user interaction.

Exploitation status: CISA KEV lists this vulnerability, and news reporting states limited, targeted exploitation on Pixel devices. No public exploit code was found in the findings.

KEV meaning here: CISA adds vulnerabilities to KEV when they judge them to be exploited in the wild; this elevates prioritization and imposes a remediation timeline.

Exploit maturity: confirmed exploited in targeted campaigns (per KEV/news); no public exploit code reported, but that does not reduce urgency due to real-world use.