Google Pixel CVE-2026-58704: September update and CISA KEV explained

Pixel owners should check for the September update now

Google’s 15 September Pixel Update Bulletin says CVE-2026-58704 may be under limited, targeted exploitation. The Google Pixel September 2026 update contains the fix, and Google says a 2026-09-05 or later Pixel security patch level addresses every issue in that bulletin. For someone using a supported Pixel, the practical response is straightforward: check the device’s security-update level and install the normal update when it is available. There is no need to search for unofficial firmware or try to diagnose the vulnerability yourself.

CVE-2026-58704 is a High-severity modem issue that Google classifies as elevation of privilege. Its public CVE description says a logic error can permit a permission bypass in the cellular modem and could lead to proximal or adjacent privilege escalation without user interaction. That technical description does not mean every unpatched phone is compromised. It does mean an update deserves priority, especially because Google has disclosed the limited, targeted exploitation indication.

What Google has confirmed about the Pixel modem vulnerability

Google placed CVE-2026-58704 in the Pixel part of its September bulletin, with Modem as the affected subcomponent. The associated CVE record was published on 15 September and describes a possible permission bypass caused by a logic error. NVD reproduces the same underlying description and displays a CISA-ADP CVSS 3.1 score of 8.8 High, while noting that an NVD assessment was not yet provided at the source-check time. Severity scores help prioritise fixes, but they do not describe a particular owner’s exposure or prove an attempted attack against a specific phone.

The important wording from Google is narrow: there are indications that the CVE may be under limited, targeted exploitation. Google has not publicly named an actor, a spyware vendor, a government, a victim, or a number of affected people. It has not published a public exploit chain or a model-by-model list limited to this CVE. Independent coverage has reported the patch and the public technical description, but does not turn those missing details into confirmed facts. Readers should be wary of posts that make the exploitation sound universal or claim to identify those behind it without a primary source.

The public description also says user interaction is not needed. That is a reason not to treat familiar warning signs, such as suspicious links, as the only security control. It is not an instruction to test a phone, and it does not establish that a phone is affected merely because it has received an unexpected call, message or network interruption. Applying the vendor update is the appropriate consumer action.

How to check the Pixel 2026-09-05 security patch level

Start in Settings. Open About phone, or About tablet on a Pixel Tablet, then Android version. The Android security update field shows the installed security-update level. Google says 2026-09-05 or any later level addresses CVE-2026-58704 and the other issues in its September Pixel bulletin. If the displayed date is older, return to Settings, select System, then Software updates, and follow the device’s on-screen instructions.

Google says system updates may be delivered through a notification or the Settings screen, and advises using Wi-Fi and charging the device to at least 75% before an update. Update schedules vary by device, manufacturer and mobile carrier. A reader who cannot see the update immediately should recheck the official update screen later rather than assume the handset is excluded or download a file from an email, social post or unrelated website.

Supported Pixel devices are the scope of Google’s bulletin, but the sources reviewed do not provide a separate, complete affected-model list just for CVE-2026-58704. A phone that is no longer receiving security updates needs a different risk decision; Google’s ordinary update-support information is the right starting point for that question. A work, school, or government-managed Pixel may be subject to device-management controls, so its owner should also follow the organisation’s approved update process.

CISA KEV entry is a new federal action, not a consumer deadline

The newer event is CISA’s 16 September addition of CVE-2026-58704 to its Known Exploited Vulnerabilities Catalog. The catalog labels the issue Google Pixel Improper Authorization Vulnerability, notes that use in ransomware campaigns is unknown, and sets a 19 September due date. That action followed Google’s 15 September bulletin; it is not a new Google patch and it does not add a public account of who exploited the flaw.

The due date comes from CISA’s Binding Operational Directive 26-04, which governs in-scope U.S. Federal Civilian Executive Branch agencies and their federal information systems. CISA says those agencies must follow the directive’s risk-based remediation and forensic-triage requirements. The 19 September date is therefore not a countdown for people using a personal Pixel in India or elsewhere, nor is it a private-sector compliance deadline. For consumers, the useful message remains to install Google’s update as soon as it reaches the device.

For administrators with managed Pixel fleets, the KEV listing is a signal to use their established inventory, update and incident-response processes. The catalog’s forensic-triage language is directed to the federal framework. It should not be rephrased as proof of compromise at a private organisation. Teams outside that scope can still prioritise the vendor patch, validate installation, and use their own policies for monitoring and escalation.

What this update does not establish

The September bulletin confirms a fix and says exploitation may be limited and targeted. It does not say that exploitation is widespread, that all vulnerable Pixels were reached, or that a particular app, carrier, region or user group is involved. The reviewed sources also do not show a victim count, an attributed attacker, a spyware-vendor connection, a ransomware link, or a public method to reproduce the issue. Those limits matter because the device patch is clear while the public attack picture remains deliberately sparse.

A CISA KEV entry is valuable evidence that U.S. authorities want affected federal systems prioritised. It is not a diagnosis for an individual device, a declaration that every Pixel model is affected, or a promise that an update prevents every kind of mobile compromise. Keep the operating system and apps current, use official update channels, and seek trusted organisational or device support if there is a separate reason to suspect a security incident. Avoid sending sensitive device data to unsolicited callers or supposed support accounts.

A sensible next step for people and organisations

For a personal phone, verify the Android security update date, request the update through Settings if needed, install it when available, and restart if prompted. Keep the device connected to a trustworthy network while it completes. The goal is to reach 2026-09-05 or later, not to chase technical details about the Google Pixel modem vulnerability. Google’s patch statement is the reliable test of remediation at this stage.

Security teams may also want to place this alert alongside their normal priority queue rather than treat it as a stand-alone incident report. Reddy News has separately covered Cisco Secure Email Gateway CVE-2026-76461 and the Windows 11 KB5129195 RDS update, both of which show why vendor fixes and agency actions can have different operational meanings. Those related reports are available in the Technology section and the related-story cards on this page. The shared principle is simple: confirm the vendor’s fix, identify the systems in scope, and do not expand a limited public disclosure into claims the evidence does not support.