Our automated tracking framework flagged that CISA added CVE-2026-58704 (Google Pixel) to the Known Exploited Vulnerabilities (KEV) catalog on September 18, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-58704 by September 19, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-58704 |
| Vendor / product | Google Pixel |
| Vulnerability | Google Pixel Improper Authorization Vulnerability |
| CVSS base score | 8 |
| Added to KEV | September 16, 2026 |
| Days public before listing (NVD → KEV lag) | 1 |
| Federal patch deadline | September 19, 2026 |
| Known ransomware use | No |
How This Compares to Google’s Track Record
This one was public for just 1 days before CISA confirmed exploitation — faster than Google’s 7-day median, meaning attackers moved unusually quickly.
| Google in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 75 |
| Median lag (public → KEV listing) | 7 days |
| 0-day rate (exploited at or before disclosure) | 24% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1712 tracked KEV entries is 251 days — Google’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Google KEV Additions
The most recent Google vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-87491 | Chromium V8 | September 9, 2026 | 0 | No |
| CVE-2026-85046 | Chromium V8 | September 4, 2026 | 1 | No |
| CVE-2026-11645 | Chromium V8 | June 9, 2026 | 0 | No |
| CVE-2026-5281 | Dawn | April 1, 2026 | 0 | No |
| CVE-2026-3909 | Skia | March 13, 2026 | 0 | No |
What This Means for Defenders
CISA has added CVE-2026-58704, an Improper Authorization Vulnerability affecting Google Pixel, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw has a CVSS base score of 8, presenting significant risk. Federal agencies must apply patches by September 19, 2026, just three days after its KEV listing. Organizations using Google Pixel devices should patch before September 19, 2026, to mitigate active exploitation risks.
This vulnerability was public for only one day before its KEV listing, indicating a high likelihood of active exploitation. The short window for detection and response means defenders must act quickly. While there’s no confirmed ransomware use, the speed of exploitation suggests it’s being actively targeted.
If immediate patching isn’t feasible, restrict device access to critical resources and enhance monitoring for unusual activity originating from Pixel devices. These are essential interim measures to reduce exposure until the patch can be deployed.
Related Coverage
- Google’s CVE-2026-85046 Was Exploited in 1 Days — Faster Than Its 7-Day Median (September 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
