CVE-2026-19910

CVE-2026-19910 (tracked as ZDI-CAN-30585, disclosed as ZDI-26-526) is an improper cryptographic signature verification flaw (CWE-347) in the application installer of PAX Technology Q80 payment terminals. A network-adjacent, unauthenticated attacker can supply an application package that the installer accepts without verifying its cryptographic signature, allowing malicious applications to be installed on the device. Successful exploitation yields arbitrary code execution, and when combined with other vulnerabilities the attacker can run code in the context of root. Any deployed Q80 terminal reachable from an adjacent network segment, such as a store LAN or Wi-Fi, is affected; no affected or fixed version ranges were specified in the available data. No public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS currently estimates only a 0.2% probability of exploitation within 30 days.

What to do: Monitor the PAX advisory and ZDI-26-526 for the fixed firmware release and update Q80 terminals promptly once a patched version is published, since no fixed version is named in the available data. Until then, segment terminals away from untrusted adjacent networks (e.g., a dedicated VLAN separate from guest or customer Wi-Fi), restrict application installation and updates to trusted management channels such as the vendor's device management platform, and avoid sideloading application packages directly onto devices. With no known public PoC and low EPSS, patching in a normal maintenance window is reasonable, but merchants with flat in-store networks should prioritize segmentation.