CVE-2026-58704: Google Pixel Improper Authorization Vulnerability
Google · Pixel · NVD published 2026-09-16 · posted 2026-09-16 · last modified 2026-10-08
What it is
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
| Weakness | CWE-285CWE-693 |
|---|---|
| CVSS vector | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (source: 134c704f-9b21-4f2e-91b3-4a467353bcc0) |
| CISA due date | 2026-09-19 (for US federal agencies under BOD; a good deadline for everyone) |
| ATT&CK tactics | Stealth |
Exploitation evidence
First exploit evidence seen: 2026-09-16 (earliest date across the sources below).
Exploited in the wild
- CISA KEV: listed since 2026-09-16. Source
Sources: CISA KEV.
Defend the Chain
The attack chain for CVE-2026-58704 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.
Pick a red technique card on the board, then choose the defence that stops it.
Defend against T1211 Exploitation for Stealth Inferred
Inferred from CWE CWE-693
How to fix it
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (source: CISA KEV)
Fixed versions
NVD does not list a fixed version for this CVE. Use the vendor advisory below.
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
MITRE ATT&CK mitigations for this chain
- M1050 Exploit Protection (for T1211) : Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploi
- M1051 Update Software (for T1211) : Update software regularly by employing patch management for internal enterprise endpoints and servers.
- M1019 Threat Intelligence Program (for T1211) : Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.
- M1048 Application Isolation and Sandboxing (for T1211) : Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in t
Detection Generic guidance
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.