ZDI-26-140: Trend Micro Apex One Origin Validation Error Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One NT Listener service. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71213.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-140?
The severity of ZDI-26-140 is classified as high due to its potential for local privilege escalation.
How do I fix ZDI-26-140?
To fix ZDI-26-140, it is recommended to update to the latest version of Trend Micro Apex One that addresses this vulnerability.
Which versions of Trend Micro Apex One are affected by ZDI-26-140?
ZDI-26-140 affects specific installations of Trend Micro Apex One, particularly those that are not updated with the latest security patches.
What type of attack does ZDI-26-140 enable?
ZDI-26-140 enables local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent.
Who is at risk from ZDI-26-140?
Local users with low-privileged access to systems running affected versions of Trend Micro Apex One are at risk from ZDI-26-140.