CVE-2026-58868 Patch Status: Samsung Lists the Android Fix, Pixel Has No November Bulletin Yet, and How to Enforce 2026-11-01 Across Company Phones
Samsung's November release lists the fix for critical Android flaw CVE-2026-58868, but Google had posted no November Pixel bulletin by November 9. Here is who has it and how to enforce the patch safely.
Where Worldwide
On this page 8 sections
Samsung's November security release now lists the fix for CVE-2026-58868, the critical Android flaw that needs no tap or click, but Google had not posted a November bulletin for its own Pixel phones when we checked on November 9, 2026. If your company runs on Android phones, tablets or scanners, the question has moved from "is there a patch?" to "which of our devices actually have it?"
Our earlier post on the November Android update covered what Google fixed. This one covers what has happened since, who is still waiting, and how to enforce the patch without locking out your own staff.
CVE-2026-58868 patch status by phone maker
Everything in this table comes from the manufacturer's own pages, checked on November 9, 2026.
| Devices | What the source shows | What to do |
|---|---|---|
| Samsung monthly list: Galaxy S23 to S26 series, Z Fold5 and Z Flip5 onward, A54 to A57 5G, XCover7, XCover7 Pro, Tab Active5 Pro | SMR-NOV-2026 published November 3, CVE list updated November 5, CVE-2026-58868 listed as Critical | Install when offered, then confirm the date on the device |
| Samsung quarterly list, including XCover5, XCover6 Pro, Tab Active4 Pro, Tab Active5 | No November date given for these models | Check each one, and expect them to lag |
| Google Pixel | No November row. Newest bulletin is October 2026, published October 6, patch level 2026-10-05 | Keep checking the Pixel bulletin page |
| Other brands | We did not review each maker | Check that maker's own security page |
| Android 13 or older | Not among the versions Google lists | Plan replacement |
Samsung warns that "delivery time of security patches may vary depending on the regions and models," and its support list says some carriers may support only quarterly updates. A bulletin listing means the fix is in Samsung's release. It does not mean a given phone has received it.
Pixel timing moves around. Google's Pixel bulletins this year came out on July 7, August 4, September 15 and October 6, so a gap in early November is not alarming on its own. We found no date from Google for November.
What is confirmed about the Android flaw
- Google's bulletin, published November 2 and revised November 6, rates CVE-2026-58868 Critical and says it could lead to remote code execution with no user interaction. The revision note says only "Issues list updated."
- The CVE record describes a heap buffer overflow in
onOutputReceivedofFrameDecoder.cpp, and lists Android 14, 15, 16, 16 QPR2 and 17 as affected. - The 9.8 severity score in the record comes from CISA, not Google. CISA's assessment, dated November 3, records exploitation as "none" and automatable as "yes."
- The flaw was not in CISA's Known Exploited Vulnerabilities catalog in the November 9 edition.
- CVE-2026-58868 is not in the bulletin's Google Play system updates table. A recent Google Play system update date does not show this flaw is fixed.
What is claimed, and what is still not known
Claimed, not confirmed by Samsung: a trade report says the November patch began reaching the Galaxy S26 series, Z Fold7 and Z Flip7 around November 4. It names no countries or build numbers. Treat it as a sign of direction, and rely on what your own devices report.
Not known:
- How an attacker would reach the vulnerable code. Neither the bulletin nor the CVE record says which file, message or app would trigger it.
- Whether anyone has used it. The bulletin makes no statement either way. CISA's records show no known exploitation, which is not proof that none has happened.
- When the code change will be easy to study. Google says it publishes source patches within 48 hours and adds links to the bulletin, but on November 9 this entry showed only the reference A-486464711 with no link. That does not prove the code is unpublished. Published fixes are, in general, something attackers can study, which is one more reason not to wait.
- When Pixel phones get the November fix.
Why a patch date rule can lock out your own staff
This is the part that matters most for a company network. The flaw needs no action from the user, so training does not help. The practical control is making work access depend on the patch level, and that control can backfire if you set it carelessly.
Microsoft Intune is a common example. Its Android Enterprise compliance policies have a Minimum security patch level setting, entered as YYYY-MM-DD, for fully managed, dedicated, corporate-owned work profile and personally owned work profile devices. By default, Intune marks a device noncompliant immediately, and Conditional Access can then block it from company resources.
Set that date to 2026-11-01 for everyone today and a Pixel with no update available fails the rule, along with any quarterly rugged device still waiting. Your warehouse could lose access because of a date in a policy. Intune lets you change the schedule to create a grace period, and to send users an email first.
Other device management tools name these settings differently, and we only checked Intune. On a personal phone you cannot make the owner install an update, but you can make work access depend on it. If your Android devices also carry email or sign-in codes, those are what you are protecting.
How to check the Android security patch level
Google's path is Settings, then About phone, then Android version. Two dates matter:
- 2026-11-01 or later covers CVE-2026-58868.
- 2026-11-05 or later covers everything in the November bulletin, including kernel and chip maker fixes.
On Samsung devices, also look at Security software version. Samsung says SMR Nov-2026 Release 1 includes all patches from Samsung and Google.
What to do this week
| Step | How |
|---|---|
| Get the real numbers | Export the patch level of every Android device from your management tool, and check unmanaged ones by hand |
| Sort into groups | Patched, Samsung monthly waiting, Samsung quarterly, Pixel waiting, no update path |
| Push what exists | Install the November release on Samsung monthly devices and confirm the date changed |
| Ignore the wrong signal | Do not count a Google Play system update as the fix for this flaw |
| Set floors by group | Apply 2026-11-01 only where the update is available, with a grace period and a user email |
| Check rugged devices | Find XCover and Tab Active models on Samsung's quarterly list, and limit what they can reach if they lag |
| Find dead ends | Replace anything on Android 13 or older. Pixel 5a and earlier no longer get updates. Pixel 6 and 7 series phones get five years from first US availability, so check the older ones |
| Watch for a change | Recheck CISA's catalog and the Pixel bulletin page weekly, and shorten your grace period if exploitation is confirmed |
Samsung's release also lists CVE-2026-58882, the Android SMS of Death flaw, so the same update handles both.
CVE-2026-58868 questions people are asking
Is CVE-2026-58868 being exploited?
Not according to the sources we checked. CISA recorded no known exploitation on November 3, and the flaw was not in its exploited list on November 9. Google's bulletin makes no statement on it.
What Android patch level fixes CVE-2026-58868?
Security patch level 2026-11-01 or later. Level 2026-11-05 or later covers the full November bulletin.
Did Samsung patch CVE-2026-58868?
Yes, it is listed as Critical in Samsung's SMR-NOV-2026 release. Delivery varies by region and model, so check each device.
Is the Pixel November 2026 update out?
Google's Pixel bulletin page had no November entry on November 9, 2026. The newest was October, at patch level 2026-10-05.
Does a Google Play system update fix this Android flaw?
No. CVE-2026-58868 is not in the bulletin's Google Play system updates table. It needs the device's security patch.
Can a company force employees' personal phones to update?
Not directly. With a personally owned work profile, a tool like Intune can set a minimum patch level and block work access from phones below it.
The bigger lesson
Google publishing a fix, a manufacturer listing it and a device installing it are three separate events, sometimes weeks apart. Only the last one protects you, and it is the only one you can measure on your own devices. A patch policy works when it is built around that fact, as we argued in who is patching the software that runs your business.
If you want patch levels tracked and enforced across your devices, see our security hardening service or request a quote.
Get security alerts by email, with the free checklist, at our security alerts page.
Sources: Android Security Bulletin, November 2026; CVE-2026-58868 record; Samsung Security Updates; Samsung update scope; Pixel Update Bulletins; Google Pixel update support; Google Android update help; CISA Known Exploited Vulnerabilities catalog; Microsoft Intune Android Enterprise compliance settings; Microsoft Intune actions for noncompliance.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Refrigeration Controller Hacks: CISA and FBI Warn Cold-Chain Businesses, What Is Confirmed and the Danfoss Firmware to Check
US agencies say attackers are targeting refrigeration and cold-chain controllers after two waves of store atta...
Cold Chain Cyberattacks: FBI and CISA Warn Refrigeration Controllers Are Being Targeted, What France Confirmed and What to Check This Week
Attackers changed refrigeration settings at about 700 French retail sites in October, and US agencies now urge...
Plex2Shell QNAP NAS Exploit: Attackers Compromise Plex Media Server on NAS Devices, the Fixed Version and How to Check Yours
QNAP says attackers have compromised Plex Media Server on some NAS devices using Plex2Shell, a four-flaw chain...
