CISA Adds Google Pixel Modem Flaw CVE-2026-58704 to KEV Catalog

CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026: CVE-2026-58704, a Google Pixel improper authorization flaw.

CISA cites active exploitation of a Pixel cellular-modem authorization bug.
CISA’s alert states the agency added CVE-2026-58704 based on evidence of active exploitation. The KEV entry describes Google Pixel devices as containing an improper authorization vulnerability in the cellular modem, where a logic error may allow an attacker to bypass permission checks and escalate privileges. The catalog lists the date added as September 16, 2026, and the due date as September 19, 2026.

Google’s Pixel bulletin flags limited, targeted exploitation.
Google’s September 2026 Pixel Update Bulletin (published September 15, 2026) lists CVE-2026-58704 as an elevation-of-privilege issue in the Modem component at High severity. Google notes there are indications the vulnerability “may be under limited, targeted exploitation.” For Google devices, security patch levels of 2026-09-05 or later address the issues in that bulletin and in the September 2026 Android Security Bulletin.

Federal agencies face a short BOD 26-04 clock.
CISA’s alert points to Binding Operational Directive 26-04, which requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV-listed high-risk vulnerabilities on publicly exposed assets and to follow the directive’s forensic-triage expectations. CISA encourages all organizations — not only federal agencies — to prioritize KEV remediation.

What this filing does and does not say.

Primary sources establish the CVE ID, modem improper-authorization / EoP classification, KEV add and due dates, and Google’s limited-targeted-exploitation note. They do not publish a public CVSS vector for this entry in the CISA alert text used here, and the September 16 CISA alert announces this single KEV addition rather than a same-day multi-CVE dump.