An origin validation flaw in the Apex One/SEP agent allows a local attacker who already has the ability to execute low‑privileged code to bypass intended sandbox limits and elevate privileges. The flaw can be exploited to run code with higher privileges, potentially enabling further compromise of the affected system. This weakness is classified as CWE‑346, which involves missing origin validation for data or instructions.

Trend Micro, Inc. products TrendAI Apex One (version 14.0.0.17079) and TrendAI Apex One as a Service (version 14.0.0.20731) are affected. Installing a newer patch or version that addresses the origin validation bug is required to mitigate the risk.

The CVSS score of 7.8 indicates a high severity, while the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because exploitation requires pre‑existing local code execution, attackers must first find or create a separate foothold before triggering the privilege escalation. Once local execution is achieved, the flaw is highly feasible to exploit and can lead to system control by an attacker.