CVE-2026-58882: An invisible text message can knock unpatched Android phones off the network

Not listed so far in CISA’s catalog of actively exploited vulnerabilities.

Our analyses

An invisible text message can knock unpatched Android phones off the network

Exploit code for this "SMS of Death" has been public since October 29. Google patched Android 14 through 17, but not versions 12 and 13. Here's how to check whether your phone is protected.

Nov 1, 20262 min read

What to do

Check whether your estate includes the affected product, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below).
Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References

NVD entry (NIST)