# CVE-2026-19910: PAX Technology Q80 Application Installer signature verification bypass

Source: https://junglewise.ai/threats/cve-2026-19910-pax-technology-q80-application-installer-signature-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19910 · Severity: high · CVSS 7.5 · Published 2026-08-14

PAX Technology Q80 is a point-of-sale terminal widely used in retail and hospitality environments. This vulnerability allows a network-adjacent attacker to install malicious applications on the device without valid authorization, executing code with root privileges. An attacker could compromise payment processing, steal customer data, or disrupt business operations.

Technologies: [PAX Technology Q80](https://junglewise.ai/threats/technologies/q80). Vendors: [PAX Technology](https://junglewise.ai/threats/vendors/pax-technology).

## Quick answers

**Is CVE-2026-19910 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19910 being exploited in the wild.

**How severe is CVE-2026-19910?** High severity, with a CVSS score of 7.5, published 14 August 2026.

**Which products and versions are affected?** PAX Technology Q80 end-of-life firmware.

**Is there a fix for CVE-2026-19910?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19910 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-19910?** Check whether you run PAX Technology Q80 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cryptographic signature verification bypass in the application installer component of PAX Q80. The installer fails to properly validate the signature of application packages before installation, allowing an attacker to install unsigned or maliciously-signed applications. Attack requires network adjacency but no authentication. An attacker can leverage this flaw in conjunction with other vulnerabilities to achieve remote code execution in the root context. The vendor has declared the affected firmware end-of-life and no longer supported; however, ZDI reports that users cannot upgrade to patched versions.

## Affected products

- PAX Technology Q80 end-of-life firmware

## Timeline

- 2026-04-22: disclosed: Vulnerability reported to PAX Technology
- 2026-04-23: other: Vendor confirmed affected firmware is end-of-life
- 2026-07-21: other: Vendor confirmed issue on reported firmware
- 2026-08-14: advisory: Coordinated public release (ZDI-26-526, CVE-2026-19910)

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-526/](https://www.zerodayinitiative.com/advisories/ZDI-26-526/)

## Related threats

- [PAX Technology Q80 AIP file parsing arbitrary file write RCE](https://junglewise.ai/threats/cve-2026-19909-pax-technology-q80-aip-file-parsing-arbitrary-file-write-rce)
- [PAX Technology Q80 XCB Daemon missing authentication](https://junglewise.ai/threats/cve-2026-19908-pax-technology-q80-xcb-daemon-missing-authentication)