**Google** has officially disclosed that a significant security vulnerability within its **Pixel Cellular Modem** is actively being exploited. The flaw, identified as **CVE-2026-58704** (CVSS score: 8.0), is a high-severity privilege escalation vulnerability. According to the **NIST National Vulnerability Database (NVD)**, the bug stems from a logic error leading to a permission bypass. This allows for "remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed," and critically, "User interaction is not needed for exploitation." ## Active Exploitation Confirmed In its advisory, **Google** confirmed indications of "limited, targeted exploitation" of **CVE-2026-58704**. However, the company has not yet provided further details regarding the nature of the attacks or the identity of the threat actors involved. ## Extensive Patch Release Beyond **CVE-2026-58704**, **Google**'s latest Pixel updates for September 2026 address a total of 109 security flaws. These include: * 88 privilege escalation vulnerabilities. * 10 information disclosure vulnerabilities. * 9 remote code execution vulnerabilities. * 2 denial-of-service (DoS) vulnerabilities. Notable among these are two high-severity kernel privilege escalation flaws (**CVE-2026-56914** and **CVE-2026-58773**), alongside 46 critical-severity vulnerabilities affecting various Pixel components such as **BigOcean**, **Bootloader**, **IP Multimedia Subsystem**, and **Trusted Execution Environment**. These critical flaws could lead to both privilege escalation and remote code execution. Users are strongly advised to update their Pixel devices to security patch levels of 2026-09-05 or later. Updates can be applied by navigating to `Settings > Security & privacy`. This follows a similar incident in June 2026, when **Google** patched another actively exploited high-severity flaw in **Android**'s Framework component (**CVE-2025-48595**, CVSS score: 8.4). ## CISA's Urgent Directive On September 16, 2026, the **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** added **CVE-2026-58704** to its Known Exploited Vulnerabilities (KEV) catalog. This mandates that all Federal Civilian Executive Branch (FCEB) agencies apply the necessary fixes by September 19, 2026. **CISA** highlighted that the vulnerability in **Google Pixel** devices involves an "improper authorization vulnerability in the cellular modem" where a "logic error may allow an attacker to bypass permission checks and escalate privileges." Crucially, **CISA** confirmed that this is a zero-click attack, meaning it requires no user interaction to exploit. Attackers can leverage the flaw silently and without the device owner's knowledge.