This vulnerability (CVE-2025-71214) affects the Trend Micro Apex One agent on Mac systems. It stems from an origin validation error in the iCore service, which could be leveraged by a local attacker who already has the ability to run low-privileged code to escalate their privileges. The vulnerability is classified under CWE-346 (Origin Validation Error). Trend Micro mitigated this issue via ActiveUpdate and SaaS updates released in mid to late 2025 (SaaS 2507 & 2005 Yearly Release). There is no vendor advisory explicitly stating the remediation level, but the description confirms the fix was deployed through updates. No evidence of exploitation in the wild has been reported.

Successful exploitation allows a local attacker with limited privileges to escalate their privileges, potentially gaining full control over the affected Mac system. This impacts confidentiality, integrity, and availability of the system. However, exploitation requires prior ability to execute code with low privileges, limiting the attack vector to scenarios where initial access is already obtained.

Trend Micro has addressed this vulnerability through ActiveUpdate and SaaS updates released in mid to late 2025. Users should ensure their Trend Micro Apex One (Mac) agents are fully updated to these versions or later. Since this is not a cloud service, remediation depends on applying these updates locally. Patch status is effectively confirmed by vendor update mechanisms. No additional mitigation actions are specified or required beyond applying these updates.