Apex One EUVD-2025-209916

Exploitation requires the attacker to already have the ability to execute low-privileged code on the target macOS host - the vendor and description state this explicitly, so it is not remotely exploitable on its own. The specific trigger is the Apex One (mac) agent's cache mechanism: the attacker must be positioned to modify the cached resource within the TOCTOU window between the agent's check and its use. Limiting factors: local access only (AV:L), an existing low-privilege account or code execution (PR:L), the target must be running the vulnerable macOS Apex One agent (not the Windows agent), and success depends on winning a timing race, which reduces reliability even though PR/UI barriers are modest and no user interaction is needed.

Signals are internally consistent and point to a genuine but bounded local risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires local access and existing low privileges but yields total compromise of the endpoint, matching SSVC's 'Technical Impact: total.' Countervailing signals lower urgency: EPSS is 0.01% (2nd percentile), SSVC exploitation is 'none,' SSVC 'Automatable: no' (a race condition is not reliably scriptable at scale), this is not on CISA KEV, and no POC is evident from the ZDI advisory. One caveat worth verifying: NVD scores AC:L, but TOCTOU races typically require winning a timing window, which often merits AC:H - the practical reliability of exploitation is therefore likely lower than the AC:L score implies. Net: a real defense-in-depth concern for hardened macOS fleets, not an emergency.

An attacker first gains an unprivileged foothold on a macOS endpoint - for example via a phishing payload or a compromised standard user account - and then runs a local tool that repeatedly manipulates a file the Apex One agent caches, racing the agent's check-then-use window (e.g. replacing a validated file with a symlink). Winning the race causes the privileged agent to act on attacker-controlled input, elevating the attacker to full endpoint control. No public POC is identified at time of analysis, and the low-complexity-but-race nature means exploitation may require multiple attempts.