Trend Micro Apex One Security Agent Plug-in User Interface Manager Arbitrary Code Execution Vulnerability

A vulnerability exists in the Trend Micro Apex One Security Agent Plug-in User Interface Manager, allowing a local attacker to bypass security measures and execute arbitrary code on affected systems. This vulnerability affects Trend Micro Apex One 2019 (On-prem) versions prior to build 13140 and Apex One as a Service versions prior to 202412 (Agent version 14.0.14203). To exploit this vulnerability, an attacker must first gain the ability to execute low-privileged code on the target system.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code on the affected system.

Remediation

Users are advised to update to Trend Micro Apex One SP1 build 13140 or to the December 2024 Monthly Maintenance (202412) for Apex One as a Service. These versions are now available.