---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One
AFFECTED_VERSIONS: Apex One (on-premise) server builds below 17079; Apex One as a Service and Vision One Endpoint Security agent builds below 14.0.20731.
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A directory traversal vulnerability in the Trend Micro Apex One on-premise server allows authenticated administrators to inject malicious code to deploy to managed endpoints.

Executive Summary:
Trend Micro Apex One is affected by a critical directory traversal vulnerability that allows administrative users to weaponize the security platform for malware distribution.

Vulnerability Details

CVE-ID: CVE-2026-34926

Affected Software: Trend Micro Apex One

Affected Versions: Apex One (on-premise) server builds below 17079; Apex One as a Service and Vision One Endpoint Security agent builds below 14.0.20731.

Vulnerability: This is a directory traversal vulnerability requiring an attacker to already possess administrative credentials for the Apex One Server. Once exploited, it allows for the modification of internal tables to distribute malicious payloads to all managed agents.

Business Impact

The CVSS score of 9.5 reflects the severe impact of this vulnerability, which effectively turns a security management tool into a vector for malware propagation. A compromise of the Apex One server allows an attacker to bypass traditional endpoint security controls across the entire enterprise environment, leading to widespread system infection and loss of control over the managed fleet.

Remediation Plan

Immediate Action: Update on-premise servers to Apex One SP1 Critical Patch Build 18012 and baseline build 17079, and update agents to build 14.0.20731 or higher.

Proactive Monitoring: Audit administrative access logs and monitor for unauthorized modifications to server configuration files or software deployment tasks.

Compensating Controls: Restrict access to the Apex One management console to known, secure administrative workstations and ensure all administrative sessions are monitored.

Exploitation Status

Public Exploit Available: True

Analyst Notes: This vulnerability is listed in the CISA KEV catalog with evidence of active exploitation in the wild.

Analyst Recommendation

This vulnerability represents an existential threat to the security of the managed endpoint environment. Administrators must move quickly to apply the provided patches, as successful exploitation results in the total failure of the organization's primary endpoint defense mechanism.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One (Mac)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
An origin validation error in the Trend Micro Apex One (Mac) agent self-protection mechanism may allow a local authenticated attacker to escalate privileges.

Executive Summary:
A local privilege escalation vulnerability in Trend Micro Apex One (Mac) poses a significant risk to endpoint integrity by allowing attackers to bypass security restrictions.

Vulnerability Details

CVE-ID: CVE-2025-71217

Affected Software: Trend Micro Apex One (Mac)

Affected Versions: See vendor advisory

Vulnerability: This is an origin validation error within the agent's self-protection mechanism. The CVSS vector (AV:L/PR:L/UI:N) confirms that a local user with low privileges can exploit this flaw to gain elevated access.

Business Impact

Successful exploitation allows a local attacker to escalate their privileges, potentially gaining full control over the affected endpoint. Given the CVSS score of 7.8, this represents a High severity risk, as it undermines the security posture of the endpoint protection agent itself, which is intended to prevent such unauthorized actions.

Remediation Plan

Immediate Action: Review the Trend Micro security advisory (KA-0022458) to identify the specific patched version and apply the update to all affected Mac endpoints immediately.

Proactive Monitoring: Audit local system logs for unusual process execution patterns or unauthorized attempts to interact with the Apex One agent service.

Compensating Controls: Ensure that local user accounts on managed endpoints follow the principle of least privilege to minimize the potential for local exploitation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it targets the self-protection mechanism of security software, providing a path for attackers to neutralize endpoint defenses.

Analyst Recommendation

This vulnerability is categorized as High severity due to the potential for privilege escalation on managed endpoints. IT administrators should prioritize identifying affected versions via the provided Trend Micro knowledge base article and apply the necessary patches as soon as they become available to maintain the integrity of their security infrastructure.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One (Mac)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
A time-of-check time-of-use (TOCTOU) vulnerability in the Trend Micro Apex One (Mac) agent cache mechanism can be leveraged by a local attacker to escalate privileges.

Executive Summary:
A local privilege escalation vulnerability in Trend Micro Apex One (Mac) enables attackers to compromise system security by exploiting a race condition in the agent cache.

Vulnerability Details

CVE-ID: CVE-2025-71216

Affected Software: Trend Micro Apex One (Mac)

Affected Versions: See vendor advisory

Vulnerability: This is a time-of-check time-of-use (TOCTOU) race condition within the agent cache mechanism. An attacker with low privileges (PR:L) on the local system can exploit this timing window to execute unauthorized code with elevated privileges.

Business Impact

This vulnerability carries a CVSS score of 7.8, indicating a high risk to business operations. By escalating privileges, an attacker could bypass endpoint security controls, leading to potential data exfiltration, malware persistence, or total system compromise of the affected workstation.

Remediation Plan

Immediate Action: Consult the Trend Micro security advisory (KA-0022458) to determine the fixed version and deploy the update across your fleet.

Proactive Monitoring: Monitor system performance and logs for signs of unexpected cache access or race condition exploitation attempts.

Compensating Controls: Restrict local administrative rights where possible to reduce the surface area for local exploitation of system services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. TOCTOU vulnerabilities are often complex to exploit but provide a reliable path for privilege escalation once a stable exploit is developed.

Analyst Recommendation

Given the High severity of this privilege escalation flaw, immediate action is required. Organizations should track the official vendor release notes for the patch and prioritize the deployment of the update to ensure that the Apex One agent's cache mechanism is properly secured against race conditions.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One
AFFECTED_VERSIONS: Trend Micro Apex One 2019 (On-prem) for Windows, and Apex One as a Service / Trend Vision One Endpoint - Standard Endpoint Protection (SaaS) for Windows and Mac.
---END_METADATA---

Description Summary:
A time-of-check time-of-use (TOCTOU) vulnerability in the Trend Micro Apex One agent iCore service signature verification allows for local privilege escalation.

Executive Summary:
A high-severity local privilege escalation vulnerability in Trend Micro Apex One could allow a local attacker to gain elevated system privileges.

Vulnerability Details

CVE-ID: CVE-2025-71215

Affected Software: Trend Micro Apex One

Affected Versions: Trend Micro Apex One 2019 (On-prem) for Windows, and Apex One as a Service / Trend Vision One Endpoint - Standard Endpoint Protection (SaaS) for Windows and Mac.

Vulnerability: This is a time-of-check time-of-use (TOCTOU) vulnerability within the iCore service's signature verification process. An authenticated local attacker must first achieve low-privileged code execution on the target system to exploit this flaw and elevate their privileges.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to bypass standard security restrictions, resulting in unauthorized administrative access to the host. Given the CVSS score of 7.0, this represents a significant risk to endpoint integrity, potentially enabling persistent malware installation or data exfiltration on compromised systems.

Remediation Plan

Immediate Action: For on-premises Windows, apply Critical Patch Build 14136. For Windows SaaS, apply Security Agent Build 14.0.20315; Mac SaaS users should ensure they are on the latest updates (SaaS 2507 & 2005).

Proactive Monitoring: Monitor system logs for unauthorized service execution or suspicious modifications to agent files that might indicate an attempt to exploit the iCore service.

Compensating Controls: Ensure that local access controls are strictly enforced to minimize the ability for unauthorized users to execute arbitrary code on endpoints where the Apex One agent is deployed.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize the deployment of the provided patches for their respective Apex One environments. Because this vulnerability facilitates local privilege escalation, mitigating the initial entry point for low-privileged users is essential to reducing the overall risk profile.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One (Mac)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
An origin validation error in the Trend Micro Apex One (Mac) agent iCore service may allow a local authenticated attacker to achieve privilege escalation.

Executive Summary:
A local privilege escalation flaw in the Trend Micro Apex One (Mac) iCore service allows authenticated users to gain elevated rights, necessitating immediate remediation.

Vulnerability Details

CVE-ID: CVE-2025-71214

Affected Software: Trend Micro Apex One (Mac)

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is an origin validation error within the agent's iCore service. An attacker with low-level local access (PR:L) can exploit this service to perform operations outside of their intended permission level.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a significant risk to organizational security. Successful exploitation grants an attacker elevated privileges, which could be used to disable security monitoring, exfiltrate sensitive data, or establish a permanent foothold on the compromised macOS system.

Remediation Plan

Immediate Action: Refer to the Trend Micro security advisory (KA-0022458) to identify and install the required security patch for the iCore service.

Proactive Monitoring: Review system logs for unusual interaction with the iCore service or unexpected service restarts that may indicate an exploitation attempt.

Compensating Controls: Implement endpoint monitoring to detect unauthorized privilege changes or anomalous service behavior on Mac environments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. As this affects a core service, it is critical to address this flaw to prevent unauthorized access to the underlying OS through the security agent.

Analyst Recommendation

The severity of this issue demands prompt attention. Security teams should prioritize patching the Trend Micro Apex One (Mac) agent to eliminate this privilege escalation risk. Ensure that all updates are verified via the official Trend Micro support portal to maintain system integrity.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One
AFFECTED_VERSIONS: TrendAI Apex One: 2019 (14.0) up to (excluding) 14.0.0.14136; TrendAI Apex One as a Service: SaaS up to (excluding) 14.0.20315
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A local origin validation error in Trend Micro Apex One allows authenticated local attackers to escalate privileges on affected systems.

Executive Summary:
A vulnerability in Trend Micro Apex One allows local attackers to achieve privilege escalation, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-71213

Affected Software: Trend Micro Apex One

Affected Versions: TrendAI Apex One: 2019 (14.0) up to (excluding) 14.0.0.14136; TrendAI Apex One as a Service: SaaS up to (excluding) 14.0.20315

Vulnerability: This is an origin validation error (CWE-346) that can be exploited by a local attacker with low privileges to escalate their authority on the host machine.

Business Impact

The ability for a local attacker to escalate privileges could lead to a full compromise of the affected endpoint, enabling the execution of arbitrary code with administrative rights. With a CVSS score of 7.8 (High), this vulnerability represents a significant risk to organizational security, as it facilitates lateral movement and persistent access for malicious actors.

Remediation Plan

Immediate Action: Update Trend Micro Apex One to version 14.0.0.14136 or higher, or update the SaaS instance to at least 14.0.20315.

Proactive Monitoring: Review system access logs for unauthorized attempts to invoke management functions or unexpected privilege changes.

Compensating Controls: Restrict local system access to authorized personnel only to minimize the potential attack surface for local privilege escalation exploits.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to already have local access to the target system.

Analyst Recommendation

Given the potential for privilege escalation and the high CVSS severity rating, administrators should prioritize applying the provided security updates. Patching the affected software is the only reliable method to mitigate the underlying origin validation flaw.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One
AFFECTED_VERSIONS: TrendAI Apex One: 2019 (14.0) up to (excluding) 14.0.0.14136; TrendAI Apex One as a Service: SaaS up to (excluding) 14.0.20315
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A link following vulnerability in the Trend Micro Apex One scan engine allows local attackers to escalate privileges on affected installations.

Executive Summary:
A link-following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges, leading to unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2025-71212

Affected Software: Trend Micro Apex One

Affected Versions: TrendAI Apex One: 2019 (14.0) up to (excluding) 14.0.0.14136; TrendAI Apex One as a Service: SaaS up to (excluding) 14.0.20315

Vulnerability: This is an improper link resolution vulnerability (CWE-59) that permits a local attacker with low privileges to manipulate file access paths to gain elevated permissions.

Business Impact

Successful exploitation allows a local attacker to bypass security constraints, potentially gaining administrative access to the host. This high-severity issue (CVSS 7.8) could result in the total compromise of the affected machine, facilitating data theft or further malicious activity within the network.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates, upgrading to version 14.0.0.14136 or the equivalent SaaS version 14.0.20315.

Proactive Monitoring: Monitor for unusual file system activity or attempts to create symbolic links in directories used by the security agent.

Compensating Controls: Implement strict file system permissions to limit the ability of non-privileged users to interact with scan engine directories.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The attack requires local access to the system.

Analyst Recommendation

Immediate patching is required to address this privilege escalation risk. Organizations should ensure all endpoints running the affected versions are updated to the latest security baseline provided by Trend Micro.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One Management Console
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A secondary vulnerability in the Trend Micro Apex One management console allows remote attackers to upload malicious code and execute commands.

Executive Summary:
A critical remote code execution vulnerability in the Trend Micro Apex One management console permits unauthorized command execution.

Vulnerability Details

CVE-ID: CVE-2025-71211

Affected Software: Trend Micro Apex One Management Console

Affected Versions: See vendor advisory

Vulnerability: Similar to CVE-2025-71210, this flaw affects a different executable within the management console, enabling remote code execution via malicious file uploads. It requires network access to the console to exploit.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for full system compromise. If exploited, an attacker could manipulate security policies, exfiltrate sensitive data, or deploy malware, effectively nullifying the protection provided by the security software itself.

Remediation Plan

Immediate Action: Apply the latest vendor-supplied patches for all on-premises Apex One installations.

Proactive Monitoring: Audit access logs for the management console and investigate any suspicious file upload activities.

Compensating Controls: Restrict access to the management console to authorized administrative subnets and consider using a VPN to tunnel management traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability must be addressed immediately alongside CVE-2025-71210. Organizations should verify their security posture by ensuring all management consoles are isolated from untrusted networks.

---METADATA---
VENDOR: Trend Micro
PRODUCT: Apex One Management Console
AFFECTED_VERSIONS: Apex One 2019 (On-Prem)
---END_METADATA---

Description Summary:
A directory traversal vulnerability in the Trend Micro Apex One management console allows remote code execution through malicious file uploads.

Executive Summary:
A critical directory traversal vulnerability in the Trend Micro Apex One management console allows for remote code execution by authenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-71210

Affected Software: Trend Micro, Apex One Management Console

Affected Versions: Apex One 2019 (On-Prem)

Vulnerability: This is a Console Directory Traversal Remote Code Execution issue. While the vulnerability allows for command execution, it requires the attacker to have access to the management console to initiate the upload of malicious code.

Business Impact

The CVSS score of 9.8 reflects the high severity of this flaw. Compromise of the Apex One management console grants an attacker control over the endpoint security environment, enabling them to disable security agents, deploy malware, or exfiltrate data from across the entire corporate network.

Remediation Plan

Immediate Action: Apply Critical Patch Build 14136 for on-premise Windows installations of Apex One 2019. SaaS versions have been mitigated automatically by the vendor.

Proactive Monitoring: Audit administrative access logs for the management console and investigate any unauthorized file upload or configuration change activities.

Compensating Controls: If the console is externally exposed, restrict access to trusted source IP addresses and ensure the console is not accessible via the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 21, 2026, Trend Micro is not aware of in-the-wild exploitation for this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Securing the management console is paramount to maintaining organizational security. Administrators should apply the specified Critical Patch immediately and review network exposure to prevent potential exploitation of this high-risk vulnerability.

Executive Summary:
A high-severity vulnerability has been identified in Trend Micro security products, specifically affecting Cleaner One Pro. This flaw allows a local user with low privileges to escalate their permissions, which could lead to the deletion of critical security files, effectively disabling the product and leaving the system exposed to further attacks. Organizations are urged to apply the vendor-provided patch immediately to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2025-53503

Affected Software: Trend Micro Multiple Products

Affected Versions: See vendor advisory for specific affected versions of Trend Micro Cleaner One Pro.

Vulnerability: The vulnerability is a local privilege escalation within the Trend Micro Cleaner One Pro component. The cleaning function of the software does not properly validate file paths before deletion. An attacker with local, low-privilege access to a system can exploit this by creating a symbolic link from a location the cleaner tool targets (e.g., a temporary cache directory) to a critical, high-privilege Trend Micro system file. When the cleaner utility is run by a privileged user or the system, it will follow this symbolic link and delete the protected file, leading to a denial-of-service condition for the security product.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8. Exploitation would directly impact the integrity and availability of the Trend Micro security solution on an affected endpoint. By disabling the security software, an attacker can bypass endpoint protection, antivirus scanning, and other security controls, rendering the system vulnerable to subsequent attacks such as malware deployment, data exfiltration, or ransomware. This creates a significant risk of a minor security incident escalating into a major breach, potentially leading to data loss, operational downtime, and reputational damage.

Remediation Plan

Immediate Action:

• Patch Immediately: Deploy the patched version of the affected Trend Micro software provided by the vendor across all vulnerable endpoints without delay.
• Review Permissions: Conduct a review of user permissions and access controls on endpoints. Ensure that non-administrative users have the minimum necessary privileges to perform their roles, reducing the attack surface for local exploits.

Proactive Monitoring:

• Monitor system logs for unexpected termination or failures of Trend Micro services and processes.
• Implement File Integrity Monitoring (FIM) on Trend Micro's installation directories to generate alerts on any unauthorized file modifications or deletions.
• Scrutinize endpoint detection and response (EDR) logs for suspicious process chains involving the Cleaner One Pro executable or unusual file deletion activity originating from low-privilege user accounts.

Compensating Controls:

• If patching is not immediately feasible, consider restricting the execution of the Cleaner One Pro tool using application control solutions like AppLocker or other software restriction policies.
• Enforce the principle of least privilege rigorously to limit the ability of local users to write to locations that could be leveraged in this type of attack.
• Increase monitoring on systems that cannot be patched to detect any signs of compromise quickly.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2025, there are no known public proof-of-concept exploits or active in-the-wild exploitation campaigns targeting this vulnerability. However, local privilege escalation vulnerabilities are often targeted by threat actors who have already established an initial foothold in a network, as they are a key step in escalating an attack.

Analyst Recommendation

Given the high severity score and the potential for complete security product bypass, immediate remediation is strongly recommended. Although this CVE is not currently on the CISA KEV list, its nature as a local privilege escalation makes it a valuable tool for any attacker who has gained initial access. Organizations must prioritize patching all systems running the affected Trend Micro software. The focus should be on applying the vendor patch first and then implementing compensating controls and enhanced monitoring on any systems where patching is delayed.

Executive Summary:
A high-severity vulnerability has been identified in multiple Trend Micro products, specifically affecting the Worry-Free Business Security Services (WFBSS) agent. This flaw, resulting from missing authentication, could permit a remote, unauthenticated attacker to gain complete control over the security agent, effectively neutralizing endpoint protection and potentially using it to launch further attacks within the network. Organizations are urged to apply the vendor-provided patches immediately to mitigate this critical risk.

Vulnerability Details

CVE-ID: CVE-2025-53378

Affected Software: Trend Micro Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the Trend Micro WFBSS agent due to a lack of proper authentication mechanisms for critical functions. An unauthenticated attacker on the network can send specially crafted requests to an exposed service on the agent. Because the service does not validate the source or authenticity of the request, it will process the malicious commands, allowing the attacker to alter the agent's configuration, disable security features, or execute arbitrary code with the agent's system-level privileges, leading to a full compromise of the endpoint.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.6. Successful exploitation would have a significant business impact by undermining the core security posture of affected endpoints. An attacker could disable antivirus scanning, firewall rules, and other protective measures, rendering the system defenseless against malware, ransomware, and data exfiltration attempts. Furthermore, since security agents are trusted components, a compromised agent could be leveraged as a pivot point for lateral movement, escalating the breach across the organization's network and leading to widespread system compromise and data loss.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by Trend Micro to all affected agents immediately. After patching, system administrators should review Trend Micro agent logs and system access logs for any signs of unauthorized access or configuration changes that may have occurred prior to the update.

Proactive Monitoring: IT security teams should actively monitor for indicators of compromise. This includes scrutinizing network traffic for unusual connections to or from the Trend Micro agent processes, particularly from untrusted network segments. Monitor endpoint logs for unexpected agent service terminations or restarts, and review agent audit logs for any configuration changes not initiated by administrators.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the attack surface. Use host-based or network firewalls to restrict inbound network access to the ports used by the Trend Micro agent, allowing connections only from the trusted Trend Micro management console and other necessary administrative servers.

Exploitation Status

Public Exploit Available: False (as of July 10, 2025)

Analyst Notes: As of the publication date, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. The CISA Known Exploited Vulnerabilities (KEV) catalog does not list CVE-2025-53378. However, given the nature of the vulnerability (remote, unauthenticated control), it is highly likely to be targeted by threat actors in the near future.

Analyst Recommendation

Given the high severity score and the critical function of the affected software, this vulnerability presents a significant risk to the organization. The ability for an unauthenticated attacker to remotely control a security agent is a critical failure that must be addressed with urgency. We strongly recommend that all system owners prioritize the immediate deployment of the vendor-supplied patches across all affected endpoints. Although there is no evidence of active exploitation, the risk of future compromise is substantial, and proactive patching is the most effective defense.