What is the CVSS score of CVE-2025-71217?

CVE-2025-71217 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Trend Micro are affected by CVE-2025-71217?

Trend Micro Apex One for macOS is vulnerable to privilege escalation attacks by local users, creating a direct threat to endpoint security protection and system integrity across your Mac fleet.

How to fix or mitigate CVE-2025-71217?

Within 24 hours, create a complete inventory of all macOS systems running Trend Micro Apex One, noting system owners, user counts, and security criticality. Within 7 days, implement interim controls by restricting administrative account provisioning to essential personnel only, enabling privilege escalation detection and alerting, and directly contacting Trend Micro for patch availability and temporary mitigation guidance. By day 30, continue monitoring for patch release, test the effectiveness of compensating controls through security assessments, and establish a deployment plan to apply the patch immediately upon release.

Trend Micro CVE-2025-71217

EUVD-2025-209915 HIGH

Origin Validation Error (CWE-346)

2026-05-21 trendmicro

GHSA-8q9p-gxfg-8f5c

Privilege Escalation Trend Micro Trendai Apex One Mac

7.8

CVSS 3.1 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (trendmicro) · only source for this CVE.

CVSS VectorVendor: trendmicro

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:28 vuln.today

CVE Published

May 21, 2026 - 13:03 cve.org

HIGH 7.8

CVE Published

May 21, 2026 - 13:03 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).

AnalysisAI

Local privilege escalation in the Trend Micro Apex One (Mac) agent lets a low-privileged user abuse a flaw in the agent's self-protection mechanism to gain elevated (root-level) control on affected macOS installations. The root cause is an origin validation error (CWE-346) in the component meant to prevent tampering with the security agent itself. There is no public exploit identified at time of analysis; EPSS is negligible (0.01%) and CISA SSVC records no known exploitation, but a Zero Day Initiative advisory (ZDI-26-143) confirms independent researcher validation of the issue.