CVE-2026-12214: Qihoo 360 Privilege Escalation Flaw

CVE-2026-12214 Overview

CVE-2026-12214 is a protection mechanism failure [CWE-693] affecting Qihoo 360 Total Security 6.0. The flaw resides in the RpcStringBindingComposeW function within the Nucleus Engine Monitoring Logic component. An attacker who manipulates the NetworkAddr argument can defeat a security control intended to guard the engine. The attack requires local access and low privileges, but no user interaction. A public exploit has been released, increasing the risk of opportunistic abuse. The vendor was contacted before disclosure but did not respond, leaving deployed installations without an official remediation path at the time of publication.

Critical Impact
A local attacker can bypass the security engine's protection mechanism by controlling the NetworkAddr argument passed to RpcStringBindingComposeW, undermining the antivirus product's integrity, confidentiality, and availability guarantees.

Affected Products

Qihoo 360 Total Security 6.0
Nucleus Engine Monitoring Logic component
RpcStringBindingComposeW function within the engine

Discovery Timeline

2026-06-15 - CVE-2026-12214 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database
2026-06-18 - Exploit Prediction Scoring System (EPSS) score recorded at 0.124%

Technical Details for CVE-2026-12214

Vulnerability Analysis

The vulnerability is classified under [CWE-693] Protection Mechanism Failure. The Nucleus Engine Monitoring Logic in Qihoo 360 Total Security 6.0 invokes the Windows RPC helper RpcStringBindingComposeW to assemble a string binding handle used for inter-process communication. The function accepts a NetworkAddr argument that defines the network endpoint to bind. When this argument is reachable from a local low-privileged context, an attacker can manipulate it to subvert the engine's intended protection workflow. The result is a failure of the safeguard that the engine relies on to validate or constrain its monitoring activity, undermining confidentiality, integrity, and availability of protected processes.

Root Cause

The root cause is insufficient validation and trust boundary enforcement around the NetworkAddr input consumed by RpcStringBindingComposeW inside the Nucleus Engine. The protection mechanism that should isolate or sanitize this input fails to do so, allowing local actors to influence binding composition. Because the binding handle is part of the engine's monitoring control plane, manipulating it disables or redirects the protection logic rather than producing a simple crash.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. The attacker supplies a crafted value for the NetworkAddr parameter through the path that ultimately reaches RpcStringBindingComposeW. A public proof-of-concept exploit has been released, lowering the barrier for attackers seeking to disable host antivirus protection before staging additional payloads. Refer to the VulDB Vulnerability Details and GitHub Issue Discussion for the published technical write-up.

Detection Methods for CVE-2026-12214

Indicators of Compromise

Unexpected modifications, restarts, or termination of Qihoo 360 Total Security service processes on endpoints running version 6.0.
Local processes spawning child processes that interact with the Nucleus Engine's RPC endpoints with anomalous NetworkAddr values.
Sudden silencing of telemetry from the 360 Total Security agent without a corresponding administrative action.

Detection Strategies

Hunt for low-privileged user sessions invoking RPC binding APIs (RpcStringBindingComposeW, RpcBindingFromStringBinding) against the 360 engine's interfaces.
Compare expected versus observed binding strings used by the Nucleus Engine and alert on deviations.
Correlate antivirus service health degradation with concurrent local process execution from non-administrative accounts.

Monitoring Recommendations

Forward endpoint process creation, module load, and RPC activity logs to a centralized analytics platform for retrospective hunting.
Monitor Windows Security and System event logs for service stop, crash, and recovery events associated with 360 Total Security.
Track outbound and local IPC patterns from the engine to detect bindings to unexpected endpoints.

How to Mitigate CVE-2026-12214

Immediate Actions Required

Inventory all hosts running Qihoo 360 Total Security 6.0 and treat them as exposed until a vendor patch is available.
Restrict local logon and interactive access on affected systems to trusted administrators only, reducing the population able to reach the local attack surface.
Enable tamper protection and service recovery alerts so that disruption of the security engine generates immediate notification.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted early but did not respond. Monitor the VulDB CVE Entry for updates and consider replacing or supplementing the affected antivirus product until a fix is released.

Workarounds

Replace or layer Qihoo 360 Total Security 6.0 with an alternative endpoint protection product on critical assets while the issue remains unpatched.
Apply the principle of least privilege so that standard users cannot run arbitrary code that reaches the engine's RPC interface.
Apply application allowlisting to block execution of the public proof-of-concept binary and similar tooling.

bash

# Configuration example: enumerate hosts with the affected product for prioritized response
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like '*360 Total Security*' -and $_.Version -like '6.0*' } |
  Select-Object PSComputerName, Name, Version