Vulnerability · Published Mar 9, 2026 · Assigned by VulDB

CVE-2026-3796Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control

Medium 5.3

In plain English

A medium-severity improper access control in QAX Virus Removal from Qi-ANXIN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 85.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureIO_Imp.sys of the component Mini Filter Driver. Executing a manipulation can lead to improper access controls. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Qi-ANXIN	QAX Virus Removal	2025-10-22

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-349763 | Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control vdb-entry, technical-description
VDB-349763 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #758991 | Qi-ANXIN QAX Virus Removal Version 2025.10.22 and earlier Improper Access Controls third-party-advisory
https://github.com/cwjchoi01/FocusKiller related
https://github.com/cwjchoi01/FocusKiller/tree/main/FocusKiller exploit