ZDI 2026-03-03

ZDI-26-148: Trend Micro Apex Central Improper Authentication Privilege Escalation Vulnerability

CVE-2025-71209

Machine-generated analysis · WAYSCloud LLM

The vulnerability requires authentication and allows privilege escalation in Trend Micro Apex Central.

Context

Trend Micro Apex Central is affected by an improper authentication vulnerability. The vulnerability enables privilege escalation by remote attackers who are authenticated. The ZDI assigned a CVSS score of 8.1, indicating high severity according to the scoring system. Worth noting is that the advisory specifies authentication is required, which may limit exploitability to authorized users.

Operator considerations

Check: Determine if Trend Micro Apex Central is deployed and identify its version.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to escalate privileges on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2025-71209.

Read the full advisory on ZDI →