Trend Micro Apex One CVE-2025-71212

The attacker must already have the ability to execute low-privileged code on the target Windows endpoint (interactive logon, a foothold from a prior phishing payload, or any user-context process) and the vulnerable Trend Micro Apex One scan engine must be installed and running - specifically on-premise Apex One 2019 build below 14.0.0.14136 or Apex One as a Service below 14.0.20315. Exploitation is constrained to local attack vector only (CVSS AV:L) - no network-reachable exploit path - and requires the attacker to be able to create symbolic links, NTFS junctions, or hard links in a filesystem location the SYSTEM-privileged scanner touches, which on default Windows configurations is available to standard users for junctions but typically requires SeCreateSymbolicLinkPrivilege for true symlinks. No user interaction is needed (UI:N), and authenticated low-privileged access is required (PR:L).

The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-impact local privilege escalation: the attacker needs only low-privileged code execution on the endpoint, no user interaction, and gains full confidentiality, integrity, and availability impact through SYSTEM-level abuse. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided, so widespread opportunistic exploitation appears unlikely in the immediate term. However, because Apex One is an endpoint security product widely deployed across enterprises and ZDI-26-138 published an advisory, this class of bug is a well-known post-compromise stepping stone - attackers who have landed initial access through phishing or another vector frequently chain such EoP flaws to disable the very EDR/AV product they are running in. The local-only attack vector materially limits scope versus a remote RCE, but the high technical impact and the privileged context of an AV scan engine make this a meaningful priority for patching on endpoints where untrusted code may execute.

An attacker who has obtained an initial low-privileged shell on a Windows endpoint - for example via a phishing payload or a separate browser exploit - plants a symbolic link or NTFS junction in a directory the Apex One scan engine writes to during quarantine or update operations, redirecting a SYSTEM-level file operation onto a sensitive target such as a privileged binary or registry hive backing file. When the scan engine performs the operation, the attacker either overwrites a SYSTEM-owned file with attacker-controlled content or deletes a protected file to enable a DLL hijack, resulting in SYSTEM code execution. No public exploit has been identified at time of analysis, though the ZDI advisory indicates the technique is documented.