CISA just listed a Pixel modem bug. Check the date on the phone, not the MDM checkbox.

Work phones get treated like accessories. They sit on the same Wi-Fi as the shop laptop, they hold MFA prompts, and they roam through hotel lobbies and job sites. Google's September Pixel bulletin is a reminder that the radio stack is still an attack surface. CISA added CVE-2026-58704 to the Known Exploited Vulnerabilities catalog today, September 16, and set a September 19 federal deadline.

What Google actually said

The September 2026 Pixel update covers 110 issues. Google called out one of them as possibly already in use. CVE-2026-58704 is a high-severity elevation of privilege in the cellular modem. The bulletin language is dry: a logic error in the modem can bypass a permission check. An attacker on an adjacent network, meaning radio range rather than the open internet, can escalate privileges. No extra user click. No extra privileges required to start.

Google's wording is careful. "There are indications that CVE-2026-58704 may be under limited, targeted exploitation." That is not a mass-scan story. It is the kind of bug that shows up in a targeted kit: someone near the device, or on a shared radio path, who already has a foothold and wants more.

Supported Pixels move to the 2026-09-05 patch level. That build also folds in the rest of the September Android security bulletin. Pixel gets its own list because Google owns the hardware. The OEM Android bulletin is not a substitute if the device is a Pixel.

Why a modem bug lands on an IT checklist

Most offices do not manage Pixels like they manage laptops. MDM is optional. Patch evidence is a screenshot if it exists at all. Meanwhile the same handset approves bank transfers, opens the camera NVR app, and sits next to the person who can reset Active Directory.

Adjacent-network does not mean "only if you are standing in the parking lot." Shared cellular, a malicious femtocell, or a close-range radio setup is enough in the threat model Google described. You do not need to understand the modem firmware. You need to know whether staff phones are on last month's patch.

CISA's KEV row also asks for forensic triage under BOD 26-04. For a civilian shop that means: if a Pixel used for admin work was unpatched while this was listed as exploited, do not treat "I tapped update this morning" as the whole answer. Check whether the device was in scope for any odd account activity in the same window.

What we would check this week

• On each managed Pixel: Settings, Security and privacy, System and updates, Security update. You want 2026-09-05 or later. Look at the date on the device, not the MDM policy that says updates are allowed.
• If you issue Pixels for privileged work (email admin, banking, camera apps, VPN), treat the patch as an emergency change, not a user courtesy.
• Unmanaged personal Pixels that reach corporate mail or MFA should still get the same ask. A BYOD policy that cannot verify patch level is a policy in name only.
• After the update, restart. Half-applied radio firmware is a common support ticket.
• If a device cannot take the build, retire it from privileged use. Unsupported Pixels do not get this bulletin.

Bottom line

A targeted modem bug is easy to dismiss until the phone is the second factor for everything else. Forensic Five helps Canadian organizations verify what is actually patched and write it down for a board or an insurer. From St. Albert, Alberta. Phones count as systems.