Is CVE-2026-19908 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19908 being exploited in the wild.

How severe is CVE-2026-19908?

High severity, with a CVSS score of 7.1, published 14 August 2026.

Is there a fix for CVE-2026-19908?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-19908 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-19908?

Check whether you run PAX Technology Q80 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19908: PAX Technology Q80 XCB Daemon missing authentication

CVE-2026-19908 · Severity: high · CVSS 7.1 · Published 2026-08-14

The PAX Technology Q80 is a payment processing device used in retail and hospitality environments. The XCB daemon component lacks proper authentication controls, allowing network-adjacent attackers to access sensitive configuration data and modify device settings without any credentials. Combined with other vulnerabilities, this could enable arbitrary code execution with root privileges, potentially compromising payment card data and device integrity.

Technologies: PAX Technology Q80. Vendors: PAX Technology.

Quick answers

Is CVE-2026-19908 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19908 being exploited in the wild.
How severe is CVE-2026-19908?: High severity, with a CVSS score of 7.1, published 14 August 2026.
Which products and versions are affected?: PAX Technology Q80 <UNKNOWN>.
Is there a fix for CVE-2026-19908?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19908 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-19908?: Check whether you run PAX Technology Q80 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in the XCB daemon of the PAX Q80 payment terminal. The flaw allows unauthenticated network-adjacent attackers to access sensitive functionality and modify device configuration. The attack requires network proximity (AV:A) but no user interaction or privileges. An attacker can disclose sensitive information and modify configuration; in combination with other vulnerabilities, arbitrary code execution as root is possible. The vendor confirmed the issue affects reported firmware versions but indicated end-of-life status; no patch availability has been communicated as of publication.

Affected products

PAX Technology Q80 <UNKNOWN>

Timeline

2026-04-22: disclosed: Vulnerability reported to vendor
2026-04-23: other: Vendor confirmed reported firmware was end-of-life
2026-07-21: other: Vendor confirmed issue on reported firmware
2026-08-05: advisory: Coordinated public release (ZDI-26-524)
2026-08-14: other: CVE-2026-19908 published, advisory updated

References

https://www.zerodayinitiative.com/advisories/ZDI-26-524/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.