An origin validation error in the iCore service of Trend Micro Apex One for macOS enables a local attacker who can already execute low‑privileged code to obtain elevated privileges on the affected system. The flaw allows the attacker to send crafted requests that the service incorrectly accepts, causing operations to run with higher rights and bypass intended security boundaries. This permits the attacker to change system configuration, install malicious software, or further expand reach within the environment.

Installations of Trend Micro Apex One (Mac) that include the iCore service are impacted. No explicit version ranges are published, but the issue was fixed in mid to late 2025 updates (SaaS 2507 and 2005 Yearly Release).

The CVSS score of 7.8 indicates high severity. EPSS is not provided, suggesting no known public exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because a local code‑execution capability is a prerequisite, the risk is confined to environments where non‑privileged users can run arbitrary code. Once that condition is met, the attacker can elevate privileges and potentially compromise the entire system.