CVE-2026-45208 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in Trend Micro's TrendAI Apex One agent version 2019 (14.0). It allows a local attacker with low-privileged code execution to escalate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. No official patch or remediation guidance has been provided by the vendor. Exploitation requires prior local access, and no known exploits are reported in the wild.
CVE-2026-45207 is a high-severity origin validation vulnerability in the Trend Micro TrendAI Apex One agent (version 2019, 14.0). It allows a local attacker with low privileges to escalate their privileges on the affected system. Exploitation requires the attacker to already have the ability to execute low-privileged code locally. No official patch or remediation guidance has been provided by the vendor at this time. There are no known exploits reported in the wild.
CVE-2026-45206 is an origin validation vulnerability in Trend Micro's Apex One/SEP agent version 2019 (14.0) that allows a local attacker with low privileges to escalate their privileges. The vulnerability arises from improper origin validation in a process protection communication mechanism. It has a high severity rating with a CVSS score of 7.8. Exploitation requires prior ability to execute low-privileged code on the target system. No patch or official remediation has been confirmed yet.
CVE-2026-34930 is a high-severity origin validation vulnerability in Trend Micro's Apex One/SEP agent version 2019, 14.0. It allows a local attacker with limited code execution privileges to escalate their privileges by exploiting improper origin validation in a process protection mechanism. No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.
CVE-2026-34929 is a high-severity origin validation vulnerability in Trend Micro's Apex One 2019 (14.0) agent. It allows a local attacker with low privileges who can execute code on the system to escalate their privileges. This vulnerability involves improper origin validation in an inter-process communication mechanism distinct from a related CVE-2026-34927. No official patch or remediation guidance has been published yet, and no known exploits have been reported in the wild.
CVE-2026-34928 is a high-severity origin validation vulnerability in Trend Micro TrendAI Apex One/SEP agent version 2019 (14.0). It allows a local attacker with low-privileged code execution to escalate privileges via a named pipe communication mechanism. This issue is related to improper origin validation (CWE-346) and is similar to CVE-2026-34927 but involves a different named pipe. No official patch or remediation guidance is currently available, and no known exploits exist in the wild.
CVE-2026-34927 is an origin validation vulnerability in Trend Micro's TrendAI Apex One version 2019 (14.0) that allows a local attacker with low privileges to escalate privileges on the affected system. Exploitation requires the attacker to already have the ability to execute low-privileged code locally. The vulnerability has a high severity rating with a CVSS score of 7.8. No official patch or remediation guidance has been provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-34926 is a directory traversal vulnerability in the on-premise version of Trend Micro's TrendAI Apex One server. It allows a pre-authenticated local attacker with administrative credentials on the server to modify a key table, potentially injecting malicious code that could be deployed to agents. Exploitation requires prior administrative access to the Apex One server and is limited to the on-premise deployment. The vulnerability has a CVSS score of 6.7, indicating medium severity. No official patch or remediation information is currently available, and no known exploits are reported in the wild.
An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).
A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).
A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).
CVE-2025-71214 is a high-severity vulnerability in the Trend Micro Apex One agent for Mac involving an origin validation error in the iCore service. This flaw could allow a local attacker with existing low-privileged code execution to escalate privileges on the affected system. The vulnerability requires prior access to execute code with limited privileges. Trend Micro addressed this issue through ActiveUpdate and SaaS updates in mid to late 2025. No known exploits are reported in the wild. The CVSS score is 7.8, indicating a significant impact on confidentiality, integrity, and availability if exploited.
An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable.
Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required.
For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.
A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations.
Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required.
For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.
A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations.
Please note: authentication is not required in order to exploit this vulnerability.
A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations.
Please note: authentication is not required in order to exploit this vulnerability..
A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations.
CVE-2025-54987 is a critical OS command injection vulnerability in the on-premise management console of Trend Micro Apex One version 2019 (14.0). It allows a pre-authenticated remote attacker to upload malicious code and execute commands on affected systems. This vulnerability is similar to CVE-2025-54948 but affects a different CPU architecture. The CVSS score of 9.4 indicates a high severity with network attack vector, no required privileges or user interaction, and impacts confidentiality and availability severely.
