ZDI-26-526: (0Day) PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability
ZDI discloses an unauthenticated, network-adjacent RCE in PAX Technology Q80 payment terminals via installer signature bypass, rated CVSS 7.5.
ZDI-26-526 describes a signature verification bypass in the PAX Technology Q80 application installer that lets network-adjacent attackers execute arbitrary code without authentication. The 0-day is tracked as CVE-2026-19910 and CVE-2026-19911 and carries a CVSS score of 7.5. No public patch was noted at the time of disclosure.
- Signature verification bypass enables unauthenticated RCE
- Network-adjacent attack vector against Q80 terminals
- Tracked as CVE-2026-19910 and CVE-2026-19911
- CVSS 7.5; disclosed as a 0-day
- Vendors
- PAX Technology
- Products
- PAX Technology Q80
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19910 | Signature Verification Bypass RCE in PAX Technology Q80 Application Installer | 7.5 | <1% | ||
| CVE-2026-19911 | — | — | — |
From the original article
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.