A Pixel Modem Zero-Day and a Citrix Bypass Top This Week's Exploited Flaws

Three vendors, three exploited flaws, one common thread: the devices at the network's edge and in the pocket are where attackers are working this week. Google's monthly Pixel bulletin, published on 15 September 2026, carries a zero-day that needs no tap from the victim. CISA's exploited-vulnerabilities list gained a Citrix gateway bypass with a three-day federal deadline. And Cisco's firewall management console is being used as a door by both a Russian state unit and a ransomware crew.

The Pixel flaw that needs nothing from the victim

Google's September Pixel bulletin fixes 110 vulnerabilities for devices that reach the 2026-09-05 patch level. Among them is CVE-2026-58704, rated high, in the modem subcomponent. 'There are indications that CVE-2026-58704 may be under limited, targeted exploitation,' the company said in the bulletin, as reported by BleepingComputer. Google's advisory describes 'a possible permission bypass due to a logic error in the code' in the cellular modem that 'could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed'.

In practice that means an attacker within radio proximity who already holds basic privileges on the device can quietly escalate them, in a low-complexity attack with no user interaction. Google has not said who is exploiting the flaw or which Pixel models are targeted. The 'limited, targeted' phrasing is the language Google has used for zero-days associated with commercial surveillance tools, though the company has drawn no such link here. The rest of the bulletin includes 12 remote code execution and 89 privilege escalation issues rated critical or high; a detail worth noting for hardware watchers is the cluster of high-severity escalation bugs in pKVM, the protected virtual machine layer that isolates sensitive workloads.

Three days to patch NetScaler

On 9 September CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities catalogue with a due date of 12 September for federal civilian agencies, the shortest window the agency's directive allows. The flaw is an authentication bypass using an alternate path or channel in Citrix NetScaler ADC and NetScaler Gateway when the appliance is configured as an AAA virtual server or as a gateway for SSL VPN, ICA proxy, clientless VPN or RDP proxy; CISA's entry says an unauthenticated remote attacker may be able to bypass authentication. The catalogue also flags it for forensic triage under CISA's binding directive 26-04.

The timeline is the lesson. Citrix released patches on 19 August 2026. Rapid7 wrote that day that it had seen no exploitation but expected it, because internet-facing Citrix gateways are 'nearly always exploited by threat actors'. F5 Labs' 16 September bulletin records exploitation attempts beginning around 3 September, shortly after a public proof of concept was published on GitHub. Fixed builds are 14.1-73.32 and 13.1-63.21, with separate FIPS builds; organisations that stopped at the August build for a different NetScaler flaw remain exposed to this one.

Sandworm and Qilin in the firewall console

The third item is already past the exploitation stage. Cisco Talos, as summarised in F5's bulletin, has identified three distinct intrusion clusters using two flaws in the web interface of Cisco Secure Firewall Management Center: CVE-2026-20079, an authentication bypass in a boot-time system process that yields root access to crafted HTTP requests, and CVE-2026-20316, hard-coded static credentials for a low-privileged account. One cluster deploys a web shell and JAR file to harvest credentials. A second, attributed to the Russian state-sponsored group Sandworm, modifies a licence file to establish a reverse shell and install a network-sniffing implant. A third, linked to Qilin ransomware operators, uses the static credentials for reconnaissance, disables antivirus and deploys ransomware. Cisco has issued hotfixes and advises restricting internet access to the management interface where patching cannot be immediate.

The honest reading of the week is that none of these is novel in kind. A modem bug, a gateway bypass and a hard-coded credential are old categories. What has changed is the compression between disclosure, proof of concept and exploitation, now measured in days, and the willingness of state and criminal actors to share the same doors.