A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).
References
| Link | Resource |
|---|---|
| https://success.trendmicro.com/en-US/solution/KA-0022458 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-26-141/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
05 Jun 2026, 15:25
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Trendmicro apex One
Trendmicro |
|
| References | () https://success.trendmicro.com/en-US/solution/KA-0022458 - Vendor Advisory | |
| References | () https://www.zerodayinitiative.com/advisories/ZDI-26-141/ - Third Party Advisory | |
| CPE | cpe:2.3:a:trendmicro:apex_one:-:*:*:*:-:macos:*:* cpe:2.3:a:trendmicro:apex_one:-:*:*:*:saas:macos:*:* |
21 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-367 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.0 |
21 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-21 14:16
Updated : 2026-06-05 15:25
NVD link : CVE-2025-71215
Mitre link : CVE-2025-71215
CVE.ORG link : CVE-2025-71215
JSON object : View
Products Affected
trendmicro
- apex_one
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition