Trend Micro Apex One CVE-2026-34929

Attacker must already have local, low-privileged (PR:L) code execution on a Windows host running a vulnerable Trend Micro Apex One 2019 agent (build below 14.0.0.17079) or an Apex One as a Service agent (build below 14.0.20731); the specific vulnerable IPC mechanism in the agent must be reachable from the attacker's session, which is the default for endpoint-installed agents listening on local pipes/RPC. Limiting factors are that remote exploitation is not possible (AV:L), no user interaction by another principal is required (UI:N), and exploitation is bounded to the local machine (S:U) - so this flaw cannot be used as an initial access vector and is only useful after the attacker has already landed on the endpoint.

The CVSS 3.1 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description: local attack vector, low complexity, low privileges already held, no user interaction, and full CIA impact after exploitation - the canonical local privilege escalation profile. EPSS and KEV data are not provided in the input; this CVE is not on CISA KEV based on available information, and no public exploit identified at time of analysis. SSVC-style framing: exploitation status appears to be 'none/POC unknown'; automatable is likely 'no' (attacker must already be on-host with code execution); technical impact is 'total' on the affected host. Real-world priority is moderate-to-high specifically for organizations that rely on Apex One as a tamper-resistant control or that allow standard users to execute arbitrary code (developer workstations, multi-user terminal servers), because LPE flaws in the endpoint security agent itself undermine the very boundary defenders trust. The 'similar to CVE-2026-34927' note increases urgency - a defender who patched 34927 but missed this one will still be exposed via the alternate IPC path.

A user on a corporate workstation runs a phishing-delivered loader or a malicious script that obtains low-privileged code execution under their own account. The loader connects to the vulnerable Apex One agent IPC endpoint, presenting itself as an authorized component because the agent fails to validate caller origin, and tricks the SYSTEM-level service into performing a privileged action (file write to a protected path, configuration change, or command execution) that yields SYSTEM-level code execution, after which the attacker disables endpoint protection and establishes persistence.