An origin validation flaw in the Apex One/SEP agent permits a local attacker, once able to run low‑privileged code, to elevate their privileges on the affected system. The vulnerability arises from insufficient validation of the source of inter‑process messages, enabling the attacker to trick the agent into executing privileged operations. The result is a full compromise of the local administrator credentials, granting the attacker complete control over the host.

Trend Micro Apex One versions 14.0.0.17079 and Trend Micro Apex One as a Service 14.0.0.20731 are affected. These are the current releases listed by TrendMicro and the CVE notes the vulnerability exists in the associated inter‑process communication mechanism.

The CVSS score of 7.8 places this issue in the High severity range. No EPSS score is available, and the vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires the attacker to first achieve local code execution with low privileges, after which the origin validation flaw can be abused to gain elevated rights. The attack vector is local, meaning it is primarily relevant in environments where an adversary can run code on the target machine, such as compromised user sessions or malicious local applications.