# CVE-2025-71212: Trend Micro Apex One privilege escalation in Scan Engine

Source: https://junglewise.ai/threats/cve-2025-71212-trend-micro-apex-one-privilege-escalation-in-scan-engine  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2025-71212 · Severity: high · CVSS 7.8 · Published 2026-05-21

Trend Micro Apex One is a security platform used to protect corporate endpoints from malware and cyber threats. A vulnerability in its scanning engine could allow a user who already has limited access to a computer to gain full administrative control (SYSTEM privileges). This could lead to the complete takeover of the affected machine, allowing an attacker to bypass security controls or delete critical system files.

Technologies: [Trend Micro Trend Vision One Endpoint - Standard Endpoint Protection](https://junglewise.ai/threats/technologies/trend-vision-one-endpoint-standard-endpoint-protection). Vendors: [Trend Micro](https://junglewise.ai/threats/vendors/trend-micro).

## Quick answers

**Is CVE-2025-71212 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71212 being exploited in the wild.

**How severe is CVE-2025-71212?** High severity, with a CVSS score of 7.8, published 21 May 2026.

**Which products and versions are affected?** Trend Micro Trend Vision One Endpoint - Standard Endpoint Protection SaaS Windows.

**Is there a fix for CVE-2025-71212?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-71212 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2025-71212?** Check whether you run Trend Micro Trend Vision One Endpoint - Standard Endpoint Protection at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A link following vulnerability (CWE-59) exists within the Virus Scan Engine of Trend Micro Apex One. The flaw resides in how the VSApiNt.sys driver handles file operations, which can be manipulated via symbolic links. A local attacker with low-privileged code execution can exploit this to delete arbitrary files or gain SYSTEM-level privileges. The vulnerability affects both on-premises Apex One 2019 and SaaS-based Vision One Endpoint agents on Windows. Trend Micro has released Critical Patch Build 14136 for on-premises and Security Agent Build 14.0.20315 for SaaS versions to remediate the issue.

## Affected products

- Trend Micro Apex One 2019 (On-prem) Windows; SaaS Windows
- Trend Micro Trend Vision One Endpoint - Standard Endpoint Protection SaaS Windows

## Timeline

- 2024-08-14: other: Vulnerability reported to vendor
- 2026-03-03: advisory: Coordinated public release by ZDI
- 2026-05-21: disclosed: NVD publication date

## References

- [https://success.trendmicro.com/en-US/solution/KA-0022458](https://success.trendmicro.com/en-US/solution/KA-0022458)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-138/](https://www.zerodayinitiative.com/advisories/ZDI-26-138/)

## Related threats

- [Trend Micro Apex One privilege escalation in NT Listener service](https://junglewise.ai/threats/cve-2025-71213-trend-micro-apex-one-privilege-escalation-in-nt-listener-service)
- [Trend Micro Apex One directory traversal in management console](https://junglewise.ai/threats/cve-2025-71211-trend-micro-apex-one-directory-traversal-in-management-console)
- [Trend Micro Apex One directory traversal in management console](https://junglewise.ai/threats/cve-2025-71210-trend-micro-apex-one-directory-traversal-in-management-console)