Missing Authentication in PAX Technology Q80 XCB Daemon Exposes Sensitive Information

CVE-2026-19908

What is CVE-2026-19908?

The PAX Technology Q80 XCB Daemon is plagued by a missing authentication vulnerability, enabling network-adjacent attackers to gain unauthorized access to sensitive information and tamper with configurations on affected installations. The flaw stems from inadequate authentication measures within the XCB daemon, allowing malicious actors to exploit this weakness alongside other vulnerabilities to potentially execute arbitrary code with root privileges. This vulnerability poses a significant risk to the security of installations relying on the PAX Technology Q80.

References