CVE-2025-71216
Privilege Escalation in Trend Micro Apex One macOS Agent
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: Trend Micro, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trend_micro | apex_one | to 2025 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-367 | The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a time-of-check time-of-use (TOCTOU) flaw in the cache mechanism of the Trend Micro Apex One Security Agent for macOS. It arises because the system improperly checks cache keys during signature verification.
An attacker who already has the ability to execute low-privileged code on the affected system can exploit this flaw to escalate their privileges, potentially gaining root-level access.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a local attacker with low-privileged code execution to escalate privileges to root on affected systems. Such unauthorized privilege escalation could potentially lead to unauthorized access to sensitive data or system controls.
While the provided information does not explicitly mention compliance impacts, vulnerabilities that enable privilege escalation can increase the risk of data breaches or unauthorized data access, which may affect compliance with standards like GDPR or HIPAA that require protection of sensitive data.
Organizations using the affected Trend Micro Apex One agent should apply the provided patches promptly to mitigate risks that could impact regulatory compliance.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a local privilege escalation issue in the Trend Micro Apex One agent cache mechanism that requires prior low-privileged code execution on the target system. Detection typically involves verifying the presence of vulnerable versions of the Trend Micro Apex One agent and ensuring that the system is updated with the patches released by Trend Micro.
Since the vulnerability is local and related to the cache mechanism, network-based detection is limited. Instead, detection can focus on checking the installed version of the Trend Micro Apex One agent and confirming whether the patch has been applied.
Suggested commands to detect the presence of the vulnerable software or verify patch status on a macOS system might include:
- Check installed Trend Micro Apex One version: `pkgutil --pkg-info com.trendmicro.apexone`
- Look for running Apex One processes: `ps aux | grep ApexOne`
- Verify if the system has the latest updates or patches applied by checking the software update logs or Trend Micro update tools.
For comprehensive detection, consult Trend Micro's official documentation or support channels for specific detection tools or scripts related to this CVE.
How can this vulnerability impact me? :
If exploited, this vulnerability allows a local attacker to escalate their privileges from a low-privileged user to root, which means they can execute arbitrary code with the highest system permissions.
This could lead to full system compromise, unauthorized access to sensitive data, and the ability to manipulate or disable security mechanisms.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should apply the patch released by Trend Micro that addresses the issue in the Apex One Security Agent cache mechanism.
Ensure that your Trend Micro Apex One installations are updated via ActiveUpdate or SaaS updates, specifically the SaaS 2507 and 2005 Yearly Release updates released in mid to late 2025.
Since exploitation requires prior low-privileged code execution, also ensure that your systems are protected against unauthorized code execution and maintain strong access controls.