CVE-2026-45207: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

CVE-2026-45207 is a local privilege escalation vulnerability (Origin Validation Error) in the Trend Micro Apex One and Vision One – Standard Endpoint Protection (SEP) Security Agent. The flaw exists within the Apex One NT Listener service, which fails to sufficiently validate the origin of commands, allowing a low-privileged local attacker to escalate to SYSTEM-level code execution. It affects Apex One 2019 (on-premises) agent builds below 14.0.0.17079 and Apex One as a Service / Vision One SEP SaaS agent builds below 14.0.20731, on Windows. Disclosed on May 21, 2026, it carries a CVSS v3.1 base score of 7.8 (High) (Trend Micro Advisory, GitHub Advisory).

The vulnerability is classified as CWE-346 (Origin Validation Error): the Apex One NT Listener service does not properly verify that the source of commands or inter-process communications is legitimate, allowing a low-privileged process to send commands that are accepted as if they originated from a trusted source. This is one of several related origin validation flaws (ZDI-CAN-29177) discovered in different process protection communication mechanisms within the same agent, similar to CVE-2026-45206 but affecting a distinct IPC channel. Exploitation requires the attacker to already have the ability to execute low-privileged code on the target Windows system; no network access or user interaction is needed beyond that initial foothold (Trend Micro Advisory, ZDI Advisory).

Successful exploitation allows a local attacker with low-privileged code execution to escalate privileges and execute arbitrary code in the context of the SYSTEM account, achieving complete control over the affected Windows endpoint. This grants full confidentiality, integrity, and availability impact — an attacker could exfiltrate sensitive data, install persistent malware, disable security controls, or use the compromised SYSTEM context as a pivot point for lateral movement within the network (Trend Micro Advisory, GitHub Advisory).

Trend Micro has released patched builds addressing this vulnerability. For Apex One 2019 (on-premises), update to SP1 CP Build 18012 (for existing SP1 users) or SP1 Build 17079 (for new installs), ensuring the agent build is at least 14.0.0.17079. For Apex One as a Service and Vision One SEP, update the Security Agent to build 14.0.20731 or later. Trend Micro strongly encourages customers to apply the latest available build as soon as possible, and also advises reviewing remote access policies and perimeter security controls to limit attacker access to vulnerable machines (Trend Micro Advisory).

The vulnerability was responsibly disclosed by Lays (@_L4ys) of TRAPA Security through the Trend Micro Zero Day Initiative program and was part of a broader May 2026 security bulletin addressing eight vulnerabilities across Apex One and Vision One SEP. The Belgium Centre for Cybersecurity (CCB) issued a warning advisory covering the multiple vulnerabilities in this bulletin (Trend Micro Advisory). Community reaction has been limited, consistent with the low EPSS score and absence of public exploit code.