What is the CVSS score of CVE-2025-71214?

CVE-2025-71214 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apex One are affected by CVE-2025-71214?

Trend Micro Apex One for macOS (CVE-2025-71214, CVSS 7.8) contains a local privilege escalation vulnerability in the iCore service that allows low-privilege users to gain full administrative control…

How to fix or mitigate CVE-2025-71214?

Within 24 hours, inventory all macOS endpoints running Trend Micro Apex One and alert security operations to monitor for privilege escalation attempts. Within 7 days, implement application whitelisting on high-risk macOS systems, enable enhanced logging of iCore service activity, and deploy privileged access management controls to restrict local administrative capability. Within 30 days, establish a formal monitoring cadence for Trend Micro security advisories; if no patch is released within 60 days, conduct evaluation of alternative endpoint protection solutions for macOS to reduce reliance on this vulnerable product.

Apex One CVE-2025-71214

EUVD-2025-209912 HIGH

Origin Validation Error (CWE-346)

2026-05-21 trendmicro

GHSA-jp6w-rffw-m64m

Privilege Escalation Trend Micro Trendai Apex One Mac Trend Micro Inc

7.8

CVSS 3.1 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires a pre-existing low-privileged local foothold (AV:L, PR:L) with no user interaction and low complexity; abusing the privileged iCore service yields total host compromise (C/I/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:29 vuln.today

CVE Published

May 21, 2026 - 13:02 cve.org

HIGH 7.8

CVE Published

May 21, 2026 - 13:02 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).

AnalysisAI

Local privilege escalation in the Trend Micro Apex One (mac) agent lets an attacker who already runs low-privileged code abuse an origin validation weakness (CWE-346) in the iCore service to gain full control of the endpoint. The flaw yields total confidentiality, integrity, and availability impact (CVSS 7.8) but requires an existing foothold, and no public exploit identified at time of analysis. It was discovered through the Zero Day Initiative (ZDI-26-139) and reported by the vendor; EPSS is negligible at 0.01% and CISA SSVC records no observed exploitation.

Technical ContextAI

Apex One (mac) is Trend Micro's enterprise endpoint protection agent for macOS. The vulnerable component is the iCore service, a privileged helper/daemon that other agent components communicate with. The root cause is CWE-346 (Origin Validation Error): the service fails to properly verify the origin or authenticity of the requests/clients it accepts, so a low-privileged local process can impersonate a trusted caller and invoke privileged functionality. The single CPE provided (cpe:2.3:a:trend_micro,_inc.:trendai_apex_one_(mac):*) covers the macOS agent product family only; Windows and other platform agents are not indicated by the supplied data.

RemediationAI

Patch available per vendor advisory: Trend Micro states the fix was delivered automatically through ActiveUpdate and SaaS updates in mid-to-late 2025 (SaaS 2507 and the 2005 Yearly Release), so ensure agents have applied the latest ActiveUpdate pattern/program updates and confirm the macOS agent build reflects those releases via the console. Verify update connectivity for endpoints that may have been offline, since the automatic delivery model means stale or air-gapped Macs could remain unpatched. Review the vendor solution article at https://success.trendmicro.com/en-US/solution/KA-0022458 for exact build confirmation. Because exploitation requires a pre-existing low-privileged foothold, compensating controls that limit local code execution help: restrict who can run arbitrary code on managed Macs, enforce application allowlisting, and monitor for unexpected local processes interacting with the iCore service - with the trade-off that allowlisting requires maintenance and may disrupt legitimate admin workflows.