LiveThreat Vulnerability Brief — CVE-2025-71217
What It Is — Trend Micro Apex One’s TmSelfProtect component contains an origin‑validation error that allows a low‑privileged attacker to execute arbitrary code as root on the host. Exploitability — The flaw is locally exploitable; a proof‑of‑concept exists and a vendor‑issued patch is available. CVSS 7.8 (High).
Affected Products — Trend Micro Apex One Security Agent (all versions prior to the March 2026 update).
TPRM Impact — Any organization that relies on Apex One for endpoint protection faces a supply‑chain risk: compromised agents can be leveraged to gain privileged access to client environments, potentially exposing downstream services and data.
Recommended Actions — 1️⃣ Deploy Trend Micro’s March 2026 security update immediately. 2️⃣ Verify agent versions across all managed endpoints. 3️⃣ Conduct a rapid audit for any signs of privilege‑escalation activity. 4️⃣ Review MSP contracts to ensure timely patch propagation. Source: Zero Day Initiative Advisory