HighPublic exploit

Improper Access Control in Jiangmin Antivirus 21 kvcore.sys MessageNotifyCallback

IdentifiersCVE-2026-19193CWE-284· Improper Access Control

CVE-2026-19193 is a local vulnerability in Jiangmin Antivirus 21 affecting the MessageNotifyCallback function in the kvcore.sys library, specifically within the Minifilter Port component. The flaw is caused by improper access control in a kernel-level antivirus driver interface, allowing insufficient restriction of operations reachable through that callback path. Because the vulnerable code resides in a privileged driver component, successful exploitation can allow an unprivileged local actor to interact with functionality that should be restricted, creating a path to unauthorized actions on the host.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can compromise local system security by bypassing intended access restrictions in a privileged antivirus driver component. Given the kernel-context location of the flaw, the likely impact includes local privilege escalation and other unauthorized operations that could enable deeper compromise of the affected system.

Mitigation

If you can’t patch tonight, do this now.

Restrict local access to affected systems to trusted users only, since exploitation requires local execution. Reduce opportunities for untrusted code execution through application control, least-privilege enforcement, and endpoint hardening. Monitor for suspicious interaction with antivirus driver components and consider disabling or removing the affected product where operationally feasible until a fix is available.

Remediation

Patch, then assume compromise.

Apply a vendor-provided fix for Jiangmin Antivirus 21 addressing the access control weakness in kvcore.sys and the Minifilter Port handling path. If no patch is available, update to a vendor release that corrects the vulnerable MessageNotifyCallback logic once released. Because the issue affects a kernel driver, remediation should prioritize replacing the vulnerable product version with a fixed build rather than relying solely on operational controls.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2026-19193-PoCMaturityOperationalVerified exploit

This repository is a small standalone Windows local privilege-abuse PoC for CVE-2026-19193. It contains one primary code file, CVE-2026-19193.cpp, plus a README describing the vulnerability and usage. The exploit targets Jiangmin Antivirus V21's kvcore.sys kernel driver (version 1.23.6.27), which exposes an unauthenticated minifilter communication port. The PoC connects to the driver's port (KvCorePortX0 / \\KvCorePortX0) using FilterConnectCommunicationPort, constructs a fixed-size 0x68-byte message matching the driver's expected layout, and sends command code 0x1D with a chosen TargetPid to trigger the driver's process-termination routine. Operationally, the code supports two modes: a one-shot --pid mode that kills a single specified PID, and a continuous --name mode that enumerates processes with Toolhelp32 APIs and repeatedly kills matching process instances at a configurable interval. The code includes helper logic for process-name resolution, communication-port connection attempts with and without a leading backslash, Ctrl+C shutdown handling, and basic safeguards such as skipping its own PID and PIDs below 5. There is no network activity, remote C2, or data exfiltration; this is a local exploit that weaponizes a vulnerable kernel-driver IPC interface to terminate arbitrary processes, including security software, resulting in denial of service and potential defense evasion.

patrickt2017Disclosed Aug 9, 2026c++markdownlocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

JiangminAntivirusapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

2 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2