CVE-2026-45208: Trend Micro Apex One and Vision One SEP TOCTOU privilege escalation

CVE-2026-45208 · Severity: high · CVSS 7.8 · Published 2026-05-21

Trend Micro Apex One and Vision One endpoint agents are used to protect corporate computers from malware and cyber threats. A vulnerability in these agents could allow a person who already has limited access to a computer to gain full administrative control. This could lead to the unauthorized access of sensitive data or the disabling of security protections on the affected machine.

Technologies: Trend Micro Apex One Agent, Trend Micro Apex One as a Service Agent, Trend Micro Vision One Endpoint Security Agent. Vendors: Trend Micro.

Quick answers

Is CVE-2026-45208 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45208 being exploited in the wild.
How severe is CVE-2026-45208?
High severity, with a CVSS score of 7.8, published 21 May 2026.
Which products and versions are affected?
Trend Micro Apex One as a Service Agent Below 14.0.20731.
Is there a fix for CVE-2026-45208?
A patch was published on 2026-05-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45208 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-45208?
Check whether you run Trend Micro Apex One Agent, Trend Micro Apex One as a Service Agent or Trend Micro Vision One Endpoint Security Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A time-of-check time-of-use (TOCTOU) race condition vulnerability (CWE-367) exists in the Trend Micro Apex One and Vision One Standard Endpoint Protection (SEP) agents for Windows. The flaw occurs when the agent checks a resource property before performing an action, but the resource is modified by a malicious process between the check and the use. An attacker who has already obtained low-privileged code execution on the target system can exploit this race condition to escalate their privileges to a higher level. Trend Micro has released patches for both on-premises and SaaS versions of the affected products to address this issue.

Affected products

  • Trend Micro Apex One (On-prem) Agent Below 17079
  • Trend Micro Apex One as a Service Agent Below 14.0.20731
  • Trend Micro Vision One Endpoint Security - Standard Endpoint Protection (SEP) Agent Below 14.0.20731

Timeline

  • 2026-05-21: disclosed
  • 2026-05-21: advisory
  • 2026-05-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.