Trend Micro Apex One EUVD-2026-31281

Exploitation requires the attacker to already have local low-privileged code execution on a Windows endpoint where a vulnerable Trend Micro Apex One agent (on-prem 14.0 build below 14.0.0.17079) or Apex One as a Service agent (build below 14.0.20731) is installed and running; this matches the CVSS PR:L and AV:L flags. No user interaction is required (UI:N) once the attacker is running code on the host, and no special non-default Apex One configuration is called out in the advisory - the vulnerable code path is in the agent itself. Limiting factors are the local-only attack surface (the bug cannot be triggered over the network), the need to win a timing race against the privileged process which may require multiple attempts and may be less reliable on heavily loaded or single-core systems, and the requirement that an Apex One agent build in the vulnerable range is actually deployed and active on the target.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H produces a 7.8 score and is internally consistent with the description: exploitation requires local access and at least low-privileged code execution, no user interaction, and yields full confidentiality, integrity, and availability impact within the unchanged scope - i.e., classic local privilege escalation to SYSTEM. There is no EPSS score, KEV listing, or public POC supplied with this report, so signals point to a credible but not actively exploited issue. Real-world risk is meaningful because Apex One is broadly deployed and any LPE in an EDR/AV product is attractive to post-compromise actors and ransomware operators chaining initial access into domain-wide control; however, the local-only attack vector and TOCTOU race (which may be timing-sensitive and not always reliable) make this a high but not critical priority - patch on a normal accelerated cycle rather than emergency-out-of-band unless threat intel later changes.

A user-level adversary who has already obtained code execution on a managed endpoint - for example via a phishing payload, a malicious Office macro, or a compromised low-privilege service account - runs a small helper that repeatedly triggers the vulnerable Apex One agent operation while concurrently swapping the target file, symlink, or handle it inspects, winning the race so the privileged agent process performs its sensitive action on attacker-controlled input and yields SYSTEM-level execution. With SYSTEM the attacker disables tamper protection, dumps LSASS, harvests cached credentials, and pivots to domain controllers. No public exploit identified at time of analysis, but TOCTOU races in EDR products are a well-known target class and a working exploit is feasible for a moderately skilled operator.