CVE-2026-19195
Received Received - Intake

Improper Access Control in V-Secure Jingyun Antivirus Kernel Driver

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: VulDB

Description
A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19195
EUVD
EUVD-2026-54368

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
v-secure jingyun_antivirus 2.4.2.39

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19195 is a high-severity vulnerability in V-Secure Jingyun Antivirus 2.4.2.39 affecting the kernel driver ZyArk.sys. It involves improper access controls allowing arbitrary registry key modifications through unauthenticated IOCTL requests. The driver grants full access to all users, enabling low-privileged users to perform kernel-mode registry operations as SYSTEM without validation.

Detection Guidance

Check if ZyArk.sys is loaded by running 'sc query ZyArk' or 'driverquery /si'. Look for suspicious registry modifications under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender using 'reg query' commands.

Impact Analysis

An attacker with local access could exploit this to disable critical security features like Windows Defender by modifying registry keys. This includes turning off real-time protection, behavior monitoring, and scanning capabilities, even if Tamper Protection is active. The attack requires only standard user privileges and access to the vulnerable driver.

Compliance Impact

This vulnerability allows unauthorized registry modifications, which could disable security features like Windows Defender. Such changes may violate compliance requirements under GDPR or HIPAA that mandate protection of personal or health data through adequate security measures. Unauthorized disabling of protections could lead to data breaches or unauthorized access, directly impacting regulatory compliance.

Mitigation Strategies

Update Jingyun Antivirus to the latest version if available. Disable the ZyArk.sys driver using 'sc stop ZyArk' and 'sc config ZyArk start= disabled'. Restrict user access to registry keys via Windows ACLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19195. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart