A vulnerability in the Apex One scan engine allows a local attacker who already has low‑privileged execution to follow a malicious link that exploits improper pathname restrictions (CWE‑59), resulting in privilege escalation. Once elevated, the attacker could execute arbitrary code or gain persistent higher rights on the affected system.

Trend Micro Apex One and Trend Micro Apex One as a Service installations are impacted, specifically versions 14.0.0.14136 and 14.0.0.20315 respectively. These deployments remain susceptible until updated to a patched release.

The CVSS score of 7.8 reflects a high‑severity vulnerability; the EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog. Exploitation requires local code execution as a prerequisite, so the risk is confined to environments where an attacker has already breached through other means. Without that initial foothold, the likelihood of exploitation is limited.