Trend Micro Apex One Security Agent Cache race condition

Summaryinfo

A vulnerability was found in Trend Micro Apex One Security Agent. It has been declared as problematic. This impacts an unknown function of the component Cache. Executing a manipulation can lead to race condition. This vulnerability is handled as CVE-2025-71216. It is possible to launch the attack on the local host. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Trend Micro Apex One Security Agent (version now known). It has been declared as critical. This vulnerability affects some unknown processing of the component Cache. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).

The advisory is shared for download at zerodayinitiative.com. This vulnerability was named CVE-2025-71216. The exploitation appears to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/24/2026).

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Endpoint Management Software

Vendor

• Trend Micro

Name

• Apex One Security Agent

License

• commercial

Website

• Vendor: https://www.trendmicro.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion