Trend Micro Apex One iCore Service Vulnerable to Local Privilege Escalation (CVE‑2025‑71215)

LiveThreat Vulnerability Brief — CVE-2025-71215

What It Is — Trend Micro’s Apex One Security Agent contains a Time‑Of‑Check‑Time‑Of‑Use (TOCTOU) flaw in the iCore service’s signature verification routine. The defect allows a low‑privileged attacker who can execute code on the endpoint to bypass the check, gain root privileges, and run arbitrary commands. Exploitability — No public exploit code has been released, but the vulnerability is trivial to weaponize locally; CVSS v3.1 base score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Products — Trend Micro Apex One (Security Agent component) across all supported Windows versions.

TPRM Impact — Organizations that outsource endpoint protection to Managed Security Service Providers (MSSPs) or rely on third‑party vendors using Apex One inherit the privilege‑escalation risk. A compromised endpoint can become a foothold for lateral movement, potentially exposing customer data and undermining supply‑chain assurances.

Recommended Actions –

1. Deploy Trend Micro’s corrective update (KB KA‑0022458) immediately on all Apex One agents.
2. Verify patch status via centralized inventory tools; confirm version ≥ the patched release.
3. Enforce strict least‑privilege policies for service accounts and restrict local execution of untrusted code.
4. Monitor Windows Event Logs for anomalous iCore service activity and unexpected privilege‑escalation attempts.
5. Review contracts with MSSPs to ensure they maintain up‑to‑date endpoint protection and can provide evidence of patch compliance.

Source: Zero Day Initiative Advisory ZDI‑26‑141