SB2026022465 - Multiple vulnerabilities in Trend Micro Apex One for Windows



SB2026022465 - Multiple vulnerabilities in Trend Micro Apex One for Windows

Published: February 24, 2026

Security Bulletin ID SB2026022465
Severity
Critical
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Origin validation error (CVE-ID: CVE-2025-71213)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to origin validation error. A local user can escalate privileges on the system.


2) Link following (CVE-ID: CVE-2025-71212)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an insecure link following issue within the scan engine. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.


3) Path traversal (CVE-ID: CVE-2025-71211)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences in the Trend Micro Apex One management console. A remote non-authenticated attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.


4) Path traversal (CVE-ID: CVE-2025-71210)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences in the Trend Micro Apex One management console. A remote non-authenticated attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.


Remediation

Install update from vendor's website.