Trend Micro Apex One Security Agent Uncontrolled Search Path Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in the Trend Micro Apex One Security Agent. This uncontrolled search path vulnerability allows local attackers to escalate privileges on affected installations. Exploitation requires the ability to execute low-privileged code on the target system. The vulnerability arises because the product uninstaller executes a program from an unsecured location, which an attacker can exploit to gain elevated privileges and execute arbitrary code with SYSTEM rights.

Impact

Exploitation of this vulnerability allows local attackers to escalate privileges, executing arbitrary code in the context of the SYSTEM user.

Remediation

Trend Micro has released a patch for this vulnerability. Affected users can update to the latest version available through the Trend Micro Download Center.