CISA Adds Google Pixel Improper Authorization Vulnerability to KEV List

## Overview CISA added CVE-2026-58704 to its Known Exploited Vulnerabilities (KEV) list on September 16, 2026. This vulnerability affects Google Pixel devices and involves an improper authorization issue in the cellular modem. The addition to the KEV list indicates a significant risk, prompting federal agencies to address it by a specified deadline. ## Technical Details The vulnerability arises from a logic error in the code of the cellular modem. This flaw allows an attacker to bypass permission checks. As a result, it can lead to remote escalation of privileges. Notably, this exploitation does not require additional execution privileges or user interaction. The CVSS score of 8.8 highlights its severity. ## Impact If exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive functions of the device. The potential for privilege escalation poses significant risks to user data and device integrity. Given that exploitation can occur without user interaction, the threat level is elevated. ## Mitigation Google has not yet released a specific patch for this vulnerability. Users of affected Pixel devices should ensure their devices are updated with the latest security patches as they become available. Additionally, users should monitor official communications from Google for updates regarding this vulnerability and any recommended actions.