Executive brief
A security bypass vulnerability exists in Qihoo 360 Total Security's Nucleus Engine, a component responsible for monitoring and blocking suspicious system activities. An attacker with local access can bypass the software's protection mechanisms to create or modify malicious scheduled tasks without being detected. This could allow an attacker to maintain long-term access to a system, escalate their privileges, or deploy malware while remaining hidden from the security software.
Technical details
A security feature bypass vulnerability exists in the Nucleus Engine Monitoring Logic of Qihoo 360 Total Security 6.0. The engine monitors the Windows Task Scheduler RPC interface (UUID 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53) by intercepting 'RpcStringBindingComposeW' calls. However, the detection logic only looks for explicit 'localhost' strings in the 'NetworkAddr' parameter. An attacker can bypass this by setting 'NetworkAddr' to NULL or '0', which the RPC runtime still resolves to the local host but the Nucleus Engine fails to flag. This allows for the unauthorized creation or modification of scheduled tasks via 'SchRpcRegisterTask' without triggering security alerts. The vendor has reportedly not responded to the disclosure.
Affected products
- Qihoo 360 Total Security 6.0
Timeline
- 2026-06-15: disclosed: Public disclosure of the vulnerability and exploit code.
- 2026-06-15: advisory: CVE-2026-12214 published.