CVE-2026-45206: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

CVE-2026-45206 is a local privilege escalation vulnerability (Origin Validation Error) in the Trend Micro Apex One and Vision One Standard Endpoint Protection (SEP) Security Agent on Windows. The flaw resides in a process protection communication mechanism of the Apex One NT Listener service, where insufficient validation of command origin allows a low-privileged local attacker to escalate to SYSTEM-level privileges and execute arbitrary code. It was disclosed and patched on May 21, 2026, as part of Trend Micro's May 2026 Security Bulletin. Affected versions include Apex One 2019 (on-premises) agent builds below 14.0.0.17079 and Apex One as a Service / Vision One SEP SaaS agent builds below 14.0.20731. It carries a CVSS v3.1 base score of 7.8 (High) (Trend Micro Advisory, GitHub Advisory).

The vulnerability is classified as CWE-346 (Origin Validation Error) — the product does not properly verify that the source of data or communication is valid. Specifically, the Apex One Security Agent's process protection communication mechanism fails to adequately validate the origin of commands it receives, allowing a local attacker with low-privileged code execution to send crafted commands that are accepted as trusted. This is one of several related origin validation flaws (CVE-2026-34927 through CVE-2026-34930, CVE-2026-45206 through CVE-2026-45207) discovered by researcher Lays (@_L4ys) of TRAPA Security via the Zero Day Initiative (ZDI-CAN-28118), each targeting a different inter-process communication or process protection mechanism within the agent (Trend Micro Advisory, ZDI Advisory).

Successful exploitation allows a local attacker with low-privileged code execution to escalate privileges to SYSTEM context on the affected Windows endpoint, achieving full confidentiality, integrity, and availability impact. An attacker could install malware, exfiltrate sensitive data, disable security controls, or use the compromised SYSTEM-level access as a pivot point for lateral movement within the network. Because the vulnerable component is a security agent (Apex One/SEP), exploitation could also undermine the endpoint protection capabilities of the affected system (Trend Micro Advisory, GitHub Advisory).

Trend Micro has released patches addressing CVE-2026-45206. For Apex One 2019 (on-premises), update to agent build 14.0.0.17079 or later (SP1 CP Build 18012 for existing SP1 users, or SP1 Build 17079 for new installs). For Apex One as a Service and Vision One SEP, update the SaaS Security Agent to build 14.0.20731 or later. Trend Micro strongly encourages customers to apply the latest available build as soon as possible. As a general mitigating measure, restrict local code execution capabilities through proper endpoint access controls and review remote access policies to critical systems (Trend Micro Advisory).

The vulnerability was responsibly disclosed by researcher Lays (@_L4ys) of TRAPA Security through the Trend Micro Zero Day Initiative program, and Trend Micro publicly acknowledged the researcher in their security bulletin (Trend Micro Advisory). The broader May 2026 Apex One bulletin attracted attention due to Trend Micro's disclosure that at least one related vulnerability (CVE-2026-34926) was observed being exploited in the wild, prompting coverage from security news outlets and national CERTs including Belgium's CCB (CCB Advisory). Community commentary noted the irony of a security agent product being the vector for privilege escalation, with CyberKendra highlighting the issue under the headline "Trend Micro's Own Security Tool Turned Against Users" (CyberKendra).