What is the CVSS score of CVE-2025-71213?

CVE-2025-71213 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Trend Micro Apex One are affected by CVE-2025-71213?

Trend Micro Apex One, a critical component of enterprise endpoint security infrastructure, contains a local privilege escalation vulnerability (CVE-2025-71213) that allows low-privileged users to…. A patch is available.

How to fix or mitigate CVE-2025-71213?

24 hours: Generate inventory of all systems running Trend Micro Apex One; identify systems with vulnerable versions; notify endpoint security teams of patch availability. 7 days: Deploy Trend Micro's released patch to test and staging environments; complete functional validation. 30 days: Roll out patched versions to all production endpoints running Apex One; verify patch application across the environment.

Trend Micro Apex One CVE-2025-71213

EUVD-2025-209913 HIGH

Origin Validation Error (CWE-346)

2026-05-21 trendmicro

GHSA-gjcg-gjrc-j6xp

Trend Micro Privilege Escalation

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 14:18 vuln.today

Patch available

May 21, 2026 - 14:02 EUVD

DescriptionCVE.org

An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

AnalysisAI

Local privilege escalation in Trend Micro Apex One and Apex One as a Service stems from an origin validation error (CWE-346) that lets an authenticated low-privileged attacker elevate to higher privileges on the host. Trend Micro has released fixed builds and ZDI has published an advisory (ZDI-26-140); no public exploit identified at time of analysis, though vendor-reported vulnerabilities in endpoint security agents are frequent targets for post-compromise attackers.

Technical ContextAI

Apex One is Trend Micro's flagship endpoint protection platform, deployed as either on-premises software (version 2019 / 14.0) or as a managed SaaS offering. The flaw is classified as CWE-346 (Origin Validation Error), meaning a component fails to properly verify the source or identity of incoming data, requests, or IPC messages before acting on them. In endpoint security agents this class typically manifests in privileged service endpoints - named pipes, COM interfaces, local RPC, or signed-update channels - that are reachable to low-privileged callers but only check that *some* request arrived, not that the *correct* origin sent it, allowing a local process to impersonate a trusted caller and have the high-privileged service act on its behalf.

RemediationAI

Vendor-released patches are available: upgrade on-premises Apex One 2019 to build 14.0.0.14136 or later, and confirm Apex One as a Service tenants are running 14.0.20315 or later (SaaS updates are pushed by Trend Micro but tenants should verify the build number in the management console). Apply the patch following the deployment guidance in Trend Micro KA-0022458 (https://success.trendmicro.com/en-US/solution/KA-0022458) and review ZDI-26-140 (https://www.zerodayinitiative.com/advisories/ZDI-26-140/) for technical context. Until patching completes, compensating controls are limited because the vulnerable service runs on every protected endpoint; reasonable mitigations include tightening endpoint hardening to reduce the likelihood that an attacker reaches the required local low-privileged foothold (application allowlisting, restricted PowerShell/script execution, removing unnecessary local accounts), and increasing detection coverage on suspicious child processes spawning from the Apex One service tree - note these reduce but do not eliminate exploitability and may generate false positives on legitimate agent self-update activity.