A TOCTOU race condition in the Apex One/SEP agent enables local attackers to escalate privileges on affected systems.

This is a time-of-check time-of-use (TOCTOU) vulnerability within the agent's internal processes. It permits an authenticated local attacker to manipulate file or process states during the window between a security check and the subsequent action, leading to privilege escalation.

Successful exploitation allows a local user to gain elevated permissions, potentially resulting in full system compromise. With a CVSS score of 7.8, this flaw represents a significant risk to endpoint security, as it undermines the protective capabilities of the security agent itself.

Immediate Action: Deploy the latest security updates provided by Apex to address the identified race condition.

Proactive Monitoring: Monitor endpoint logs for suspicious process creation or unusual file modification patterns originating from low-privileged user accounts.

Compensating Controls: Enforce strict application whitelisting and limit local user permissions to minimize the surface area available for race condition exploitation.

Public Exploit Available: false

Organizations utilizing the Apex One/SEP agent must treat this as a high-priority update. Patching the agent software is the only reliable method to eliminate the TOCTOU flaw and prevent local escalation attacks.