This vulnerability arises from an origin validation error in the Trend Micro Apex One (Mac) agent's iCore service. Exploitation requires that an attacker already have the capability to execute code with low privileges locally. Successful exploitation could lead to privilege escalation on the target system. The issue was remediated by Trend Micro via ActiveUpdate and SaaS updates in 2025, specifically in SaaS 2507 and the 2005 Yearly Release. No cloud service is involved, and no known exploits have been reported in the wild.

If exploited, a local attacker with low-privileged code execution could escalate privileges, potentially gaining higher-level access on the affected Mac system. This could lead to unauthorized actions beyond the attacker's initial access level. However, exploitation requires prior local code execution, limiting the attack surface. No known active exploitation has been reported.

This vulnerability has been addressed by Trend Micro through ActiveUpdate and SaaS updates released in mid to late 2025 (SaaS 2507 and 2005 Yearly Release). Users should ensure their Trend Micro Apex One (Mac) agents are updated to these or later versions. No additional mitigation steps are indicated by the vendor advisory.