---
id: "CVE-2026-20599"
kind: "vulnerability"
aliases: ["CVE-2026-20599"]
title: "Modem firmware: missing permission check allows privilege escalation locally"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "infrastructure", "modem"]
not_affected_if: ["no-system-privilege-access"]
published_at: "2026-11-02T03:17:37+00:00"
first_seen_at: "2026-11-02T03:31:26+00:00"
updated_at: "2026-11-02T03:32:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20599", "first_seen_at": "2026-11-02T03:31:26+00:00"}]
---

# Modem firmware: missing permission check allows privilege escalation locally

A missing permission check in the modem component can let code that already runs with System privilege gain further privilege. The sources describe no remote path and no user interaction is needed once an attacker already holds System access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T03:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-20599

## From the sources

In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_