Vulnerabilities
TrendAI Apex One Local Privilege Escalation via Incomplete Cleanup (CVE-2025-71414)
A local privilege escalation flaw in TrendAI Apex One Security Agent allows attackers who can run low‑privileged code to gain SYSTEM rights by exploiting improper cleanup in the TmccCore component. The CVE‑2025‑71414 vulnerability has a CVSS score of 7.8. Defenders should patch immediately and monitor for suspicious process termination events.
What happened
TrendAI Apex One Security Agent has a local privilege escalation flaw (CVE‑2025‑71414) that allows an attacker who can run low‑privileged code to gain root privileges by exploiting an improper cleanup in the TmccCore component.
Impact
The vulnerability can be leveraged to execute arbitrary code as SYSTEM on affected installations. CVSS score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only systems with the vulnerable agent component are affected; no remote exploitation vector is known.
What to do
- Apply the vendor‑supplied patch (see TrendMicro support article KA‑0022458) as soon as possible.
- Verify that the Apex One agent version is at or above the patched release.
- Restrict local user privileges and monitor for suspicious process termination events.
- Consider disabling the TmccCore component if not required, or isolate the agent in a sandboxed environment.
Monitoring & Mitigation
Enable logging for process creation and termination, and look for repeated attempts to terminate TmccCore. Use endpoint detection to flag privilege‑escalation patterns.
Related vulnerabilities
TrendAI Apex One Security Agent Local Privilege Escalation via Cache Mechanism (CVE-2025-71416)
TrendAI Apex One Security Agent is vulnerable to a local privilege escalation that allows an attacker with low‑privileged code execution to gain root privileges. The flaw stems from missing cache key validation during signature verification. Defenders should apply the vendor‑issued patch immediately and verify that the Apex One agent is updated.
Read briefing
Debian Linux Kernel Vulnerabilities: Privilege Escalation, Data Breach, DoS – Immediate Update Required
Multiple kernel CVEs (CVE-2024-52560, CVE-2024-58094, CVE-2024-58095, CVE-2025-21817, CVE-2025-22104, CVE-2025-22108, CVE-2025-22127, CVE-2025-38203, CVE-2025-38205, CVE-2025-38206) affect Debian trixie kernels older than 6.12.111-1, enabling privilege escalation, confidentiality loss, and denial of service. Apply the Debian security bulletin msg00441 updates immediately and verify kernel version.
Read briefing
Hitachi Energy REB500: CVE‑2024‑8176 & CVE‑2025‑59375 Enable DoS via IEC61850
Hitachi Energy REB500 versions ≤8.3.3.1 suffer two libexpat flaws (CVE‑2024‑8176 and CVE‑2025‑59375) that can be leveraged by authenticated users to trigger a denial‑of‑service. The vendor has released a patch to 8.3.4.0; operators should update immediately and monitor IEC61850 traffic.
Read briefing
CVE‑2025‑50165: Critical Windows Imaging Component RCE via Crafted JPEG
Microsoft’s WindowsCodecs.dll contains CVE‑2025‑50165, a critical flaw that can trigger remote code execution when a specially crafted JPEG is processed. The vulnerability is in the jpeg_finish_compress routine, and while Microsoft rates it critical, exploitability is considered low. Defenders should apply the latest Windows updates, disable unnecessary image processing on servers, and monitor for anomalous JPEG handling.
Read briefing