Trend Micro Apex One and Vision One Origin Validation Vulnerability Allowing Local Privilege Escalation

A vulnerability allowing local privilege escalation has been identified in Trend Micro Apex One (both on-premise and as a service) and Vision One - Standard Endpoint Protection. This origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. However, an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a local attacker to gain elevated rights on the affected system.

Remediation

Users of Trend Micro Apex One (on-prem) should update to SP1 CP Build 18012 or SP1 Build 17079. For Trend Micro Apex One as a Service and Vision One - Standard Endpoint Protection, the latest Security Agent build 14.0.20731 should be applied.