Trendai Apex One Mac
Monthly
Local privilege escalation in the Trend Micro Apex One (Mac) agent lets a low-privileged user abuse a flaw in the agent's self-protection mechanism to gain elevated (root-level) control on affected macOS installations. The root cause is an origin validation error (CWE-346) in the component meant to prevent tampering with the security agent itself. There is no public exploit identified at time of analysis; EPSS is negligible (0.01%) and CISA SSVC records no known exploitation, but a Zero Day Initiative advisory (ZDI-26-143) confirms independent researcher validation of the issue.
Local privilege escalation in the Trend Micro Apex One (mac) endpoint agent lets a low-privileged user who already has code execution on a macOS host abuse a race condition in the agent's cache mechanism to gain full (root-level) control. The flaw was reported by Trend Micro/ZDI (ZDI-26-142) and carries a CVSS of 7.8; there is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as none.
Local privilege escalation in the Trend Micro Apex One (mac) agent stems from a race condition in the iCore service's signature verification routine, letting a low-privileged local attacker on affected macOS installations swap a verified file after the check but before use to run code with elevated (root-level) privileges. There is no public exploit identified at time of analysis, and SSVC/EPSS signals both indicate exploitation has not been observed; Trend Micro credited its own team with the report and states the issue was already remediated through ActiveUpdate/SaaS releases in mid-to-late 2025.
Local privilege escalation in the Trend Micro Apex One (mac) agent lets an attacker who already runs low-privileged code abuse an origin validation weakness (CWE-346) in the iCore service to gain full control of the endpoint. The flaw yields total confidentiality, integrity, and availability impact (CVSS 7.8) but requires an existing foothold, and no public exploit identified at time of analysis. It was discovered through the Zero Day Initiative (ZDI-26-139) and reported by the vendor; EPSS is negligible at 0.01% and CISA SSVC records no observed exploitation.
Local privilege escalation in the Trend Micro Apex One (Mac) agent lets a low-privileged user abuse a flaw in the agent's self-protection mechanism to gain elevated (root-level) control on affected macOS installations. The root cause is an origin validation error (CWE-346) in the component meant to prevent tampering with the security agent itself. There is no public exploit identified at time of analysis; EPSS is negligible (0.01%) and CISA SSVC records no known exploitation, but a Zero Day Initiative advisory (ZDI-26-143) confirms independent researcher validation of the issue.
Local privilege escalation in the Trend Micro Apex One (mac) endpoint agent lets a low-privileged user who already has code execution on a macOS host abuse a race condition in the agent's cache mechanism to gain full (root-level) control. The flaw was reported by Trend Micro/ZDI (ZDI-26-142) and carries a CVSS of 7.8; there is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as none.
Local privilege escalation in the Trend Micro Apex One (mac) agent stems from a race condition in the iCore service's signature verification routine, letting a low-privileged local attacker on affected macOS installations swap a verified file after the check but before use to run code with elevated (root-level) privileges. There is no public exploit identified at time of analysis, and SSVC/EPSS signals both indicate exploitation has not been observed; Trend Micro credited its own team with the report and states the issue was already remediated through ActiveUpdate/SaaS releases in mid-to-late 2025.
Local privilege escalation in the Trend Micro Apex One (mac) agent lets an attacker who already runs low-privileged code abuse an origin validation weakness (CWE-346) in the iCore service to gain full control of the endpoint. The flaw yields total confidentiality, integrity, and availability impact (CVSS 7.8) but requires an existing foothold, and no public exploit identified at time of analysis. It was discovered through the Zero Day Initiative (ZDI-26-139) and reported by the vendor; EPSS is negligible at 0.01% and CISA SSVC records no observed exploitation.