EUVD-2026-31285
GHSA-c93p-h3cc-p7rr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (trendmicro) · only source for this CVE.
CVSS VectorVendor: trendmicro
Lifecycle Timeline
2DescriptionCVE.org
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
AnalysisAI
Local privilege escalation in Trend Micro Apex One (on-premises 2019/14.0) and Apex One as a Service allows a low-privileged user already executing code on the host to elevate to higher privileges by abusing an origin validation weakness in the security agent. The flaw carries a CVSS 7.8 (local, low complexity) and no public exploit identified at time of analysis, but because the agent typically runs with SYSTEM-level rights, successful exploitation yields full host compromise. Trend Micro has issued patched builds (KA-0023430).
Technical ContextAI
The defect is classified as CWE-346 (Origin Validation Error), meaning the Apex One security agent - an endpoint protection component running as a privileged Windows service - accepts input, IPC messages, or control instructions without correctly verifying that the source actually has authority to issue them. CPE data identifies the affected components as cpe:2.3:a:trend_micro,_inc.:trendai_apex_one and cpe:2.3:a:trend_micro,_inc.:trendai_apex_one_as_a_service, both of which deploy an endpoint agent that exposes local interfaces for management, scanning, and update tasks. When such an agent fails to authenticate the origin of a privileged operation, a process running as a normal Windows user can impersonate a trusted caller and trick the agent into performing actions in the agent's own (SYSTEM) security context.
RemediationAI
Vendor-released patch: upgrade Apex One 2019 on-premises agents to build 14.0.0.17079 or later, and ensure Apex One as a Service tenants are on 14.0.20731 or later, per Trend Micro advisory KA-0023430 (https://success.trendmicro.com/en-US/solution/KA-0023430); SaaS tenants will receive the fix from Trend Micro centrally, while on-premises customers must distribute the agent update through the Apex One management server. Until patching completes, reduce exposure by restricting which users can execute code on endpoints running the agent - tighten AppLocker/WDAC policies, remove unnecessary local logon rights on shared/RDP/VDI hosts, and audit any service accounts that hold interactive logon. Avoid disabling the agent itself as a workaround, since that removes endpoint protection and trades a privilege-escalation risk for a broader malware risk.
More in Trendai Apex One
View allDirectory traversal in Trend Micro Apex One on-premise server (versions before 14.0.0.17079) enables a highly privileged
Remote code execution in the Trend Micro Apex One management console allows attackers with console access to upload mali
Remote code execution in Trend Micro Apex One management console allows attackers with network access to the console to
Local privilege escalation in the Trend Micro Apex One scan engine allows low-privileged users on Windows endpoints to g
Local privilege escalation in Trend Micro Apex One and Apex One as a Service agents allows an attacker with low-privileg
Local privilege escalation in Trend Micro Apex One and Apex One as a Service agents allows an attacker with low-privileg
Local privilege escalation in Trend Micro Apex One and Apex One as a Service stems from an origin validation error (CWE-
Local privilege escalation in Trend Micro Apex One and Apex One as a Service allows an authenticated low-privileged user
Local privilege escalation in Trend Micro Apex One and Apex One as a Service allows low-privileged attackers to elevate
Local privilege escalation in Trend Micro Apex One and Apex One as a Service stems from an origin validation weakness (C
Local privilege escalation in Trend Micro Apex One and Apex One as a Service security agents allows a low-privileged att
Same weakness CWE-346 – Origin Validation Error
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today