What is the CVSS score of EUVD-2025-209914?

EUVD-2025-209914 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Trend Micro Apex One are affected by EUVD-2025-209914?

Trend Micro Apex One endpoint protection contains a local privilege escalation vulnerability that allows standard Windows users to gain administrative access, compromising the security isolation…. A patch is available.

How to fix or mitigate EUVD-2025-209914?

Within 24 hours: inventory all systems running Apex One and document version numbers. Within 7 days: deploy Trend Micro patches (version 14.0.0.14136 for on-premise; version 14.0.20315 for SaaS) to test environments and validate deployment tools. Within 30 days: complete patch rollout across all production systems and confirm successful installation via Apex One administrative console.

Trend Micro Apex One EUVD-2025-209914

| CVE-2025-71212 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-05-21 trendmicro

GHSA-mp94-hxv8-mxq5

Trend Micro Privilege Escalation

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 14:18 vuln.today

Patch available

May 21, 2026 - 14:02 EUVD

DescriptionCVE.org

A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

AnalysisAI

Local privilege escalation in the Trend Micro Apex One scan engine allows low-privileged users on Windows endpoints to gain elevated privileges by abusing a link-following weakness (CWE-59) in the scanner's file-handling logic. The flaw affects on-premise Apex One 2019 builds prior to 14.0.0.14136 and the SaaS edition prior to 14.0.20315, with a patch available from Trend Micro; no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability is a link-following (symbolic link / junction) issue (CWE-59) in the Apex One scan engine, the component responsible for inspecting files on disk with elevated SYSTEM privileges. When the scanner reads, writes, or deletes files during scanning or quarantine operations, it does not adequately verify whether a target path is a symbolic link, junction, or hard link before performing privileged file operations. By planting a crafted link that redirects the scanner to a sensitive system location, a low-privileged local user can coerce the SYSTEM-level engine into performing file operations they could not perform directly. The CPE data identifies the affected products as Trend Micro Apex One (the traditional on-premise endpoint protection product) and Apex One as a Service, both of which share the same underlying scan engine code path.

RemediationAI

Apply the vendor-released patch by upgrading on-premise Apex One 2019 to build 14.0.0.14136 or later, and ensure the Apex One as a Service tenant is on 14.0.20315 or later (SaaS deployments are typically updated automatically by Trend Micro, but administrators should confirm the running build via the management console). Follow the Trend Micro advisory at https://success.trendmicro.com/en-US/solution/KA-0022458 and cross-reference ZDI-26-138 at https://www.zerodayinitiative.com/advisories/ZDI-26-138/ for technical details. Because exploitation requires local low-privileged code execution, compensating controls until patching is complete include enforcing application allow-listing (e.g., WDAC or AppLocker) to prevent untrusted binaries from running on protected endpoints, restricting interactive logon and RDP access to endpoints where Apex One is installed, and monitoring for unexpected symbolic link or junction creation by non-administrative users in directories the scanner traverses; note that disabling the scan engine itself is not an acceptable mitigation since it removes the very endpoint protection the product provides.