What is the CVSS score of CVE-2025-71215?

CVE-2025-71215 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apex One are affected by CVE-2025-71215?

Trend Micro Apex One for macOS is vulnerable to a local privilege escalation that could grant administrative access; however, no public exploit has been identified.

How to fix or mitigate CVE-2025-71215?

Within 24 hours, verify macOS Apex One deployment status and identify all systems running versions prior to the mid-2025 Trend Micro ActiveUpdate/SaaS remediation release. Within 7 days, force deploy the latest Apex One agent version to all unpatched systems through your deployment infrastructure. Within 30 days, complete a full inventory audit of all Apex One macOS deployments to confirm patch application and review any systems with automatic updates disabled.

Apex One CVE-2025-71215

EUVD-2025-209917 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-05-21 trendmicro

GHSA-rjc8-fqvx-g34c

Privilege Escalation Trend Micro Trendai Apex One Mac

7.0

CVSS 3.1 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local vector and pre-existing low privileges give AV:L/PR:L; the TOCTOU race window makes success probabilistic, so AC:H; privileged service compromise yields C/I/A:H with unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:28 vuln.today

CVE Published

May 21, 2026 - 13:02 cve.org

HIGH 7.0

CVE Published

May 21, 2026 - 13:02 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).

AnalysisAI

Local privilege escalation in the Trend Micro Apex One (mac) agent stems from a race condition in the iCore service's signature verification routine, letting a low-privileged local attacker on affected macOS installations swap a verified file after the check but before use to run code with elevated (root-level) privileges. There is no public exploit identified at time of analysis, and SSVC/EPSS signals both indicate exploitation has not been observed; Trend Micro credited its own team with the report and states the issue was already remediated through ActiveUpdate/SaaS releases in mid-to-late 2025.

Technical ContextAI

The affected component is the iCore service of the Trend Micro Apex One endpoint-protection agent for macOS (CPE cpe:2.3:a:trend_micro,_inc.:trendai_apex_one_(mac)). The root cause is CWE-367, Time-of-Check to Time-of-Use (TOCTOU): the service validates a file's cryptographic signature at one moment (time-of-check) but then acts on that file later (time-of-use), leaving a window in which an attacker who can influence the referenced path or file contents substitutes malicious content that never underwent verification. Because the iCore service runs at high privilege to perform security operations, winning this race lets an unprivileged process have privileged code loaded or executed, a classic pattern for privilege escalation in signature-gated update/loader logic.

RemediationAI

Patch available per vendor advisory: Trend Micro states the vulnerability was addressed through ActiveUpdate and SaaS updates in mid-to-late 2025, specifically SaaS 2507 and the 2005 Yearly Release, so the primary action is to ensure managed macOS agents have received current ActiveUpdate components and are running on the 2507/2005 (or later) build; consult https://success.trendmicro.com/en-US/solution/KA-0022458 and the ZDI advisory https://www.zerodayinitiative.com/advisories/ZDI-26-141/ to confirm your build is remediated. Because delivery is via the product's own update channel, verify that ActiveUpdate connectivity is healthy on endpoints and force an update check rather than assuming auto-update completed. As an interim compensating control on any endpoint that cannot be immediately updated, restrict and monitor local code execution by non-privileged users (application allowlisting, limiting interactive/local accounts) to remove the attacker's required foothold, accepting the trade-off that this constrains legitimate local tooling; no standalone standalone patch beyond the update trains is required.