CVE-2026-19909

HighCVSS 7.5

Published: 14/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

Vulnerability in PAX Technology Q80 AIP file parsing allows link following, enabling remote code execution by a network-adjacent attacker without authentication.

Risk Assessment

An attacker can abuse the installer to write arbitrary files, and combined with other vulnerabilities, execute code with root privileges.

Recommendation

Apply patches from PAX Technology for the Q80 device.

Original NVD description (English source)

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of AIP files. By creating a symbolic link, an attacker can abuse the installer process to write arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-30583.