Android security updates for November 2026: critical CVE-2026-58868, no user interaction needed
Android security updates for November 2026: critical flaw CVE-2026-58868 exploitable with no user interaction. Affected versions, 2026-11-05 level, maCERT bulletin.
The short answer: on 2 November 2026, Google published the Android security bulletin for November. The most severe flaw, CVE-2026-58868, affects the Framework component and can lead to remote code execution with no user interaction, on Android 14, 15, 16, 16-qpr2 and 17. No active exploitation has been reported so far. Morocco’s maCERT (DGSSI) published bulletin 70450311/26 on 3 November, with significant risk and critical impact. Require patch level 2026-11-05 on every smartphone and tablet that accesses company data.
In Moroccan SMEs, Android smartphones are used to read email, approve payments, receive two-factor authentication codes and talk to customers on WhatsApp. They are rarely managed and almost never checked. Here is what Google, Samsung and maCERT say, and what to do.
What the November bulletin fixes
Google sums up the most severe flaw as a critical vulnerability in the Framework component that could lead to remote code execution, with no additional execution privileges needed, and whose exploitation does not require user interaction. In practice, an attacker does not need the victim to click a link or install an app.
The bulletin also rates several other flaws as critical:
- System: two more remote code execution flaws (CVE-2026-58876, in Media Codecs, and CVE-2026-58936), three elevation of privilege flaws (CVE-2026-55275, CVE-2026-55283, CVE-2026-58984) and two denial of service flaws (CVE-2026-58814, CVE-2026-58882);
- kernel: elevation of privilege flaws in the Bluetooth stack (CVE-2026-53256, CVE-2026-89774), in pKVM (CVE-2026-59044, CVE-2026-59045, plus the information disclosure CVE-2026-59048) and in HID (CVE-2026-80604). For this section, Google states that the most severe flaw could lead to remote elevation of privilege;
- third-party components: a critical flaw in a Qualcomm closed-source component (CVE-2026-25285) and several critical flaws in the MediaTek modem, including CVE-2026-20519, CVE-2026-20520 and CVE-2026-20545 to CVE-2026-20549. For these components, severity is provided by the manufacturer.
The bulletin also fixes many high-severity flaws in Arm, Imagination (PowerVR), Unisoc and Qualcomm components.
Products, affected versions and fixed versions
| Product | Affected versions | Fixed version |
|---|---|---|
| Android (Framework, System, Android Runtime), including CVE-2026-58868 | Android 14, 15, 16, 16-qpr2 and 17 | Patch level 2026-11-01 or later |
| Android (kernel and Qualcomm, MediaTek, Arm, Imagination, Unisoc components) | Devices using the affected components | Patch level 2026-11-05 or later |
| Google Play modules (Media Codecs, MediaProvider, Profiling, Telephonycore, WiFi) | Android 10 and later | Latest Google Play system update |
| Samsung Galaxy smartphones and tablets | Models on Android 14 to 17 without the November patch | SMR Nov-2026 Release 1 (bulletin of 3 November 2026) |
Google states that devices at patch level 2026-11-05 or later address all issues for that level and all previous levels. That is therefore the only level to use as a compliance criterion. Google also announced that source code patches would be released to AOSP within 48 hours of the bulletin, so that other manufacturers can integrate them.
Exploitation: what is known
The November bulletin contains no mention of active exploitation. At the time this article was published, we found none of the critical November flaws in CISA’s KEV catalogue.
That is no reason to wait. A flaw that can be exploited remotely, with no user click, is exactly what targeted attacks against executives, accountants or sales staff look for. Once a patch is published, attackers can study it to understand the flaw, while many devices only receive their manufacturer’s update after Google’s release.
The maCERT bulletin
maCERT bulletin 70450311/26, dated 3 November 2026, is titled “Vulnerabilities affecting the Android operating system”. It covers Google Android 14, 15, 16, 16-qpr2 and 17 without the November 2026 security patch, and lists remote code execution, access to confidential information, elevation of privilege and denial of service as risks. maCERT has published a separate bulletin on Samsung Android mobile devices.
Interim measures
For devices that have not yet received the patch:
- Keep Google Play Protect enabled: Google states that it monitors for abuse and is enabled by default on devices with Google Mobile Services.
- Install the latest Google Play system update (in the device’s security settings; the location varies by manufacturer): it fixes the Media Codecs, MediaProvider, Telephonycore and WiFi modules without waiting for the manufacturer.
- Turn Bluetooth off when it is not in use, since two critical kernel flaws affect the Bluetooth stack.
- Do not install apps from outside the Play Store and refuse APK files received by message.
- Restrict access to company data from unpatched devices, with a compliance rule in your MDM or in Microsoft Intune.
Checks to run
- Record the patch level of each device under Settings > About phone, or directly in the MDM console, which shows it for the whole fleet.
- Set a compliance rule that requires a minimum patch level and blocks email, Teams or business apps below that threshold.
- List end-of-support devices: a phone that no longer receives patches will never get this one.
- Include personal phones used for work (BYOD), often forgotten, and shared tablets (reception, field work, warehouse).
- Check installed apps and remove any that do not come from the Play Store or managed Google Play.
Our view for businesses in Morocco
A company smartphone gives access to email, files, two-factor codes and often online banking. It deserves the same follow-up as a workstation: inventory, minimum patch level, access rules and remote wipe if it is lost. Without central management, nobody knows how many devices are still running an outdated patch level.
To go further, read our permanent guide to managing business smartphones with an MDM, our article on Microsoft Intune for SMBs, our patch management method, our alert on macOS and iOS security updates for Apple fleets and our guide to the phishing scams targeting SMBs. If a device looks compromised, follow our incident response plan for the first hour.
How we can help
We inventory your smartphones and tablets, deploy an MDM or Microsoft Intune with a minimum patch level rule, block data access from non-compliant devices and track updates in our 24/7 monitoring, with critical incidents handled in under 15 minutes. Discover our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.
Sources: Google, Android Security Bulletin for November 2026, Google, list of Android bulletins, Samsung, mobile security bulletins (SMR Nov-2026), maCERT: bulletin 70450311/26 (Android), maCERT: bulletin on Samsung mobile devices, CISA KEV catalogue, NVD CVE-2026-58868.
Frequently asked questions
Is CVE-2026-58868 being exploited?
Google’s bulletin reports no active exploitation for the November 2026 flaws, and we did not find it in CISA’s KEV catalogue at the time of publication. Google nevertheless rates it critical and remotely exploitable with no user interaction, so it should be patched without waiting for exploitation.
Which patch level should be installed?
Patch level 2026-11-05 or later. The 2026-11-01 level covers the Framework, System and Android Runtime, including CVE-2026-58868, but only 2026-11-05 also covers the kernel and the Qualcomm, MediaTek, Arm, Imagination and Unisoc components. The level is shown under Settings > About phone > Software information or Android version.
Are my Samsung smartphones affected?
Yes, if they run Android 14, 15, 16 or 17 without the November patch. On 3 November 2026, Samsung published its SMR Nov-2026 Release 1 bulletin, which states that it includes all patches from Samsung and Google. Rollout depends on the model, the country and sometimes the carrier: check the level actually installed.
What about phones that no longer receive updates?
A device that no longer receives security patches remains exposed to these flaws. Remove its access to company email and applications with a compliance rule in your MDM, and plan its replacement.
About the editorial team
ALLSAFE SOLUTIONS
Network, security and cloud engineers
Written by the engineering team at ALLSAFE SOLUTIONS, a managed IT provider founded in Casablanca by network, security and cloud engineers. Our articles draw on the projects we deliver for clients in Morocco and abroad.
LinkedIn
