On February 24, 2026, Trend Micro published a critical patch for Apex One endpoint security products This article explores vulnerabilities ranging cve. . On Mac and Windows systems, these vulnerabilities allow privilege escalation and remote code execution.

Apex Affected Products Windows in English is impacted by One 2019 on-premises. Trend Vision and Apex One as a Service Windows SaaS deployments are also impacted by One Endpoint Standard. In late 2025, ActiveUpdate was used to update SaaS versions for Mac. Users on-premises need to install the latest critical patch build 14136.

Eight vulnerabilities, ranging from CVE-2025-71210 to CVE-2025-71217, are covered in the bulletin. By using directory traversal in the management console, critical flaws enable unauthenticated remote attackers to upload and execute malicious code. Description of the CVE ID Severity Weakness Platform CVE-2025-71210 in CVSS v3.1 RCE success for Console Directory Traversal.

9.8 Critical CWE-22 Windows CVE-2025-71211 RCE success for Console Directory Traversal. 9.8 Windows CVE-2025-71212 Critical CWE-22 Scan Engine Link After LPE 7.8 High CWE-59 Windows CVE-2025-71213 LPE 7.8 High CWE-346 Windows CVE-2025-71214 Origin Validation Error Agent Cache TOCTOU LPE 7.8 High CWE-367 Mac CVE-2025-71216 Agent iCore Origin Validation LPE 7.2 High CWE-346 Mac CVE-2025-71215 iCore Signature Verification TOCTOU LPE 7.8 High CWE-367 Mac CVE-2025-71217 Validation of Self-Protection Origin LPE 7.8 High CWE-346 Mac Critical flaws CVE-2025-71210 and 71211 require console access and are frequently visible from the outside. If unpatched, apply source IP restrictions.

Local privilege escalations require initial low-priv access. Update to Apex One CP Build 14136 for Windows or the latest SaaS agents. The patch also enhances defenses against prior flaws CVE-2025-54987 and 54948.

Trend Micro's Download Center offers patches for download. Consoles with public IPs should be given priority.Examine the policies pertaining to remote access. There haven't been any reported in-wild exploits yet.Zero Day Initiative researchers made responsible disclosures.

X and LinkedIn to Receive More Real-Time Updates. Make ZeroOwl a Google Preferred Source.