VulnerabilityPublished 14 Aug 2026

ZDI-26-526: (0Day) PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability

Source Zero Day Initiative

Mentioned vulnerabilities

Severity

High

Rated High by Zero Day Initiative

Data as of 21 Aug 2026, 17:34 UTC

What to do

AI-suggested

The vendor advisory and ZDI recommend restricting interaction with the affected product to mitigate risk. Users should consider device replacement or network-level controls to isolate the vulnerable device.

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-19910, CVE-2026-19911.

Impact

Successful exploitation enables remote code execution with root context on affected PAX Technology Q80 devices without authentication. This can lead to full compromise of the device, including confidentiality, integrity, and availability impacts. The vulnerability is rated with a CVSS score of 7.5 (high severity). There are no known exploits in the wild at the time of disclosure.

Summary

The PAX Technology Q80 device contains a vulnerability in its application installer where the cryptographic signature verification is bypassed. This allows network-adjacent attackers to execute arbitrary code remotely without requiring authentication. The vulnerability was reported to the vendor, who confirmed the affected firmware is end-of-life and unsupported. Attempts to clarify impact on supported releases were disputed by the vendor. ZDI disagreed with the vendor's assessment and proceeded to publish the advisory as a zero-day.

References

zerodayinitiative.com/advisories/ZDI-26-526/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 12 Aug 2026, 20:14 UTC

References

Community reviews

Related threats