ZDI Advisory: PAX Technology Q80 AIP File Parsing LPE RCE via Symlink (CVE-2026-19909)

Vulnerability Overview Vulnerability Name: (0Day) PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability CVE ID: CVE-2026-19909 CVSS Score: 7.5 Publication Date: August 5, 2026 Scope Affected Vendor: PAX Technology Affected Product: Q80 Remediation Mitigations: Given the nature of the vulnerability, the only significant mitigation strategy is to restrict interaction with the product. Disclosure Timeline 2026-04-22: Vulnerability reported to vendor 2026-08-05: Coordination for coordinated public release 2026-08-14: Update issued Credit Discovered by: Steven Yu of TrendAI Research Additional Details Vulnerability Description: This vulnerability allows an adjacent network attacker to execute arbitrary code on an affected PAX Technology Q80 installation. No authentication is required to exploit this vulnerability. Specific Defect: A specific defect exists in the parsing of AIP files. An attacker can exploit the installer process to write to arbitrary files by creating symbolic links. An attacker can combine this with other vulnerabilities to execute code with root privileges. Additional Details 2026-04-22: ZDI reported vulnerability to vendor 2026-04-23: Vendor confirmed reported firmware is outdated and unsupported 2026-04-28: ZDI notified user that update to newer firmware is not possible 2026-07-11: ZDI disagreed with vendor’s assessment and provided additional evidence 2026-07-13: Vendor denied impact on supported versions 2026-07-21: Vendor confirmed issue on reported firmware 2026-07-27: Vendor requested extension to April 2027 2026-07-27: ZDI notified vendor of intent to release case as a zero day advisory Mitigations Given the nature of the vulnerability: The only significant mitigation strategy is to restrict interaction with the product. Disclosure Timeline 2026-04-22: Vulnerability reported to vendor 2026-08-05: Coordination for coordinated public release 2026-08-14: Update issued Credit Discovered by: Steven Yu of TrendAI Research Return Advice Return Advice: ← Back to Advisories Footer Information Copyright: ©2026 TRENDAI™ ZERO DAY INITIATIVE™ (ZDI) ALL RIGHTS RESERVED. Contact Us: - General Inquiries: zdi@trendmicro.com - Media Inquiries: media_relations@trendmicro.com - Sensitive Email Communications: PGP key Social Media Follow Us: - Twitter - Facebook - LinkedIn - Instagram Website Links About Us: - Our Mission - TrendAI™ - TrendAI Vision One™ How It Works: - Process - Researcher Rewards - FAQs - Privacy Advisories: - Published Advisories - Upcoming Advisories - RSS Feed Blog: - Blog Back to Top Back to Top: ↑ Summary This vulnerability allows an adjacent network attacker to execute arbitrary code on an affected PAX Technology Q80 installation without authentication. A specific defect exists in the parsing of AIP files, where an attacker can exploit the installer process to write to arbitrary files by creating symbolic links and combine this with other vulnerabilities to execute code with root privileges. The only significant mitigation strategy is to restrict interaction with the product.

Goal Reached Thanks to every supporter — we hit 100%!

ZDI Advisory: PAX Technology Q80 AIP File Parsing LPE RCE via Symlink (CVE-2026-19909)