LiveThreat Vulnerability Brief — CVE-2025-71212
What It Is — A local privilege‑escalation flaw resides in the Virus Scan Engine of Trend Micro Apex One. By crafting a malicious symbolic link, an attacker can abuse the VSApiNt.sys driver to delete arbitrary files and execute code as SYSTEM.
Exploitability — Requires the attacker to run low‑privileged code on the target machine; no public exploit has been released, but a proof‑of‑concept exists and the CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates high impact.
Affected Products — Trend Micro Apex One (Security Agent).
TPRM Impact — Organizations that rely on Apex One for endpoint protection—especially MSPs, managed security service providers, and enterprises with large endpoint fleets—face a supply‑chain risk where a compromised endpoint can become a launchpad for broader attacks against client environments.
Recommended Actions — Deploy Trend Micro’s remediation update immediately; verify all Apex One agents are running the patched version; monitor driver and file‑system logs for unexpected deletions or symlink activity; enforce least‑privilege execution policies on endpoints; and review endpoint hardening guides to mitigate symlink abuse. Source: Zero Day Initiative Advisory