An origin validation flaw in the Apex One/SEP agent permits a local attacker, once managing to run low‑privileged code on a vulnerable machine, to elevate their privileges to that of a higher level account. The weakness lies in how the agent verifies the source of received data, and it is categorized under CWE‑346. The applicability is limited to scenarios where local code execution is already possible, so the flaw alone does not allow remote compromise; it solely provides a means of privilege escalation once the attacker has foothold.

Trend Micro, Inc. products : TrendAI Apex One and TrendAI Apex One as a Service, specifically the 14.0.0.17079 and 14.0.0.20731 builds. These are the only affected versions listed in the CNA data.

The CVSS score of 7.8 reflects a high severity for local privilege escalation. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation at this time. Attackers must first obtain the ability to run code as a non‑privileged user, after which the origin validation bypass can be leveraged to elevate. Because the exploitation conditions are local and require initial code execution, the threat is confined to environments where users can execute unsigned binaries or scripts.