An origin validation flaw in TrendMicro Apex One allows a local attacker who can already run low‑privileged code to gain higher system privileges. The weakness is classified as CWE‑346 and could lead an adversary to compromise confidentiality, integrity, or availability of the entire endpoint if the privilege elevation succeeds.

Trend Micro’s Apex One 14.0.0.17079 and Apex One as a Service 14.0.0.20731 are affected. The vulnerability applies to installations of these versions by both TrendAI Apex One customers and users of the cloud‑based service.

The CVSS score of 7.8 signals high severity, but the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a local foothold, so an attacker must first execute code in a low‑privileged context before leveraging the flaw. Given a foothold, the risk to the system is significant because privileges can be escalated to administrative levels.