ZDI-CAN-26282: ZDI-26-139: Trend Micro Apex One Security Agent iCore Service Origin Validation Error Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the iCore service. The issue results from the lack of proper validation of the origin of IPC messages. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-71214.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trend Micro Apex One Security Agent (iCore service)to a version that resolves this vulnerability.Patch ZDI-26-139 - Compensating control
Until the Trend Micro Apex One Security Agent iCore service is patched, restrict local low-privileged code execution paths on the affected hosts (since exploitation requires the attacker to obtain low-privileged code execution first).
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-26282?
The severity of ZDI-CAN-26282 is rated as critical due to its potential for local privilege escalation.
How do I fix ZDI-CAN-26282?
To fix ZDI-CAN-26282, ensure that your Trend Micro Apex One Security Agent is updated to the latest version provided by the vendor.
What causes the ZDI-CAN-26282 vulnerability?
ZDI-CAN-26282 is caused by an origin validation error in the iCore service of the Trend Micro Apex One Security Agent.
Who is affected by ZDI-CAN-26282?
ZDI-CAN-26282 affects users of the Trend Micro Apex One Security Agent that have not applied the necessary security updates.
Can ZDI-CAN-26282 be exploited remotely?
No, ZDI-CAN-26282 requires local access for exploitation, as the attacker must be on the affected system.