CISA Flags Pixel Modem Flaw CVE-2026-58704, Orders Federal Patches by Sept. 19

Q: Who is deploying this silent, zero-click cellular exploit to hijack Pixel phones from nearby without any user interaction?

No one publicly knows yet. Google has said only that CVE-2026-58704 “may be under limited, targeted exploitation,” and neither Google nor CISA has identified the attacker, the victims, or the exact intrusion method. What is known is that this is a high-severity, zero-click flaw in the Pixel cellular modem that can be exploited from nearby or an adjacent network without user interaction. That profile strongly suggests a highly selective operation rather than mass criminal abuse. Security researchers and multiple reports note that modem-level zero-click bugs are the kind of capability often associated with commercial spyware vendors or state-linked surveillance operators, because they are expensive, stealthy, and typically reserved for high-value targets. That said, there is no public evidence tying this Pixel exploit to a named spyware company, government agency, or hacking group. Reports explicitly say Google has not disclosed who was behind the attacks, which Pixel models were targeted, or whether the modem bug was used alone or as part of a broader exploit chain. So the most accurate answer is that the operator remains undisclosed. The strongest public inference is that it was likely used in a limited surveillance-style campaign by a sophisticated actor, but that remains an informed assessment, not a confirmed attribution. Pixel users should install the September 2026 update with security patch level 2026-09-05 or later immediately.

2 articles · Updated · The Hacker News · Sep 16

Sept. 16, CISA added Google Pixel modem bug CVE-2026-58704 to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until Sept. 19 to apply fixes.
Google said the flaw—rated 8.0—has seen limited, targeted exploitation in the wild; the logic error lets attackers bypass permission checks and escalate privileges without user interaction.
The bug can be used in zero-click attacks, allowing silent compromise of nearby Pixel devices through the cellular modem with no link click or file open required.
Google fixed CVE-2026-58704 in its September 2026 Pixel update, which also patched 109 other flaws; devices on security patch level 2026-09-05 or later are protected.