A local privilege escalation vulnerability in Trend Micro Apex One (Mac) enables attackers to compromise system security by exploiting a race condition in the agent cache.

This is a time-of-check time-of-use (TOCTOU) race condition within the agent cache mechanism. An attacker with low privileges (PR:L) on the local system can exploit this timing window to execute unauthorized code with elevated privileges.

This vulnerability carries a CVSS score of 7.8, indicating a high risk to business operations. By escalating privileges, an attacker could bypass endpoint security controls, leading to potential data exfiltration, malware persistence, or total system compromise of the affected workstation.

Immediate Action: Consult the Trend Micro security advisory (KA-0022458) to determine the fixed version and deploy the update across your fleet.

Proactive Monitoring: Monitor system performance and logs for signs of unexpected cache access or race condition exploitation attempts.

Compensating Controls: Restrict local administrative rights where possible to reduce the surface area for local exploitation of system services.

Public Exploit Available: No

Given the High severity of this privilege escalation flaw, immediate action is required. Organizations should track the official vendor release notes for the patch and prioritize the deployment of the update to ensure that the Apex One agent's cache mechanism is properly secured against race conditions.