PT-2026-24004 · Qi Anxin · Qksecureio Imp.Sys+1

Jonathan126 + 1 · Published 2026-03-09 · Updated 2026-03-10 · CVE-2026-3796

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qi-ANXIN QAX Virus Removal versions prior to 2025-10-23

Description A weakness exists in Qi-ANXIN QAX Virus Removal. The issue is related to improper access controls that can be triggered by manipulating the ZwTerminateProcess function within the QKSecureIO Imp.sys library of the Mini Filter Driver component. The attack is limited to local execution. An exploit for this issue has been publicly released and could be used for attacks. The vendor was informed of this issue but did not provide a response.

Recommendations Versions prior to 2025-10-23 should be updated. As a temporary workaround, consider restricting access to the QKSecureIO Imp.sys library to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2026-3796

Affected Products

Qksecureio Imp.Sys

Qi-Anxin Qax Virus Removal

References · 12

• 🔥 https://github.com/cwjchoi01/FocusKiller/tree/main/FocusKiller · Exploit
• https://osv.dev/vulnerability/CVE-2026-3796 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3796 · Security Note
• https://vuldb.com/?id.349763 · Note
• https://github.com/cwjchoi01/FocusKiller · Note
• https://twitter.com/CVEnew/status/2031122595932717176 · Twitter Post
• https://twitter.com/CVEarity/status/2031423248764895474 · Twitter Post
• https://t.me/cveNotify/154738 · Telegram Post
• https://twitter.com/infoflowcloud/status/2031123198549295135 · Twitter Post
• https://t.me/CVEtracker/46851 · Telegram Post
• https://vuldb.com/?ctiid.349763 · Note
• https://vuldb.com/?submit.758991 · Note