CVE-2025-71217: Trend Micro Apex One Security Agent TmSelfProtect Origin Validation Error Local Privilege Escalation Vulnerability
An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the TmSelfProtect component. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71217?
The severity of CVE-2025-71217 is rated high with a score of 7.8.
How do I fix CVE-2025-71217?
To fix CVE-2025-71217, apply the latest security updates provided by Trend Micro for the Apex One Security Agent.
What systems are affected by CVE-2025-71217?
CVE-2025-71217 affects installations of the Trend Micro Apex One (Mac) agent.
What type of vulnerability is CVE-2025-71217?
CVE-2025-71217 is an origin validation error vulnerability that can lead to local privilege escalation.
What is the impact of CVE-2025-71217?
CVE-2025-71217 can allow a local attacker to escalate privileges on affected installations.