Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-45208 (ZDI-CAN-27982) |
| Alert Source | Trend Micro Security Bulletin (KA-0023430) |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-28 |
| Vendor | Trend Micro |
| Product | Apex One / Vision One Endpoint Security SEP |
| Vulnerability Type | Time-of-Check Time-of-Use (CWE-367) - LPE |
| CVSS Score | 7.8 (high) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: Trend Micro Security Bulletin
A Time-Of-Check Time-Of-Use (TOCTOU, CWE-367) vulnerability in the Trend Micro Apex One / SEP agent could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system.
Last of 8 vulnerabilities in bulletin KA-0023430. Different class from the other 7 LPEs — TOCTOU instead of origin validation. Full update context — see CVE-2026-34927.
TOCTOU is a class of race condition — an attacker exploits the time window between the check of a resource state and its use by the agent. Practical exploitation often requires symlink manipulation or rapid file swap.
Required Actions
All 8 vulnerabilities in bulletin KA-0023430 are addressed by a single patch package — see CVE-2026-34927:
- Apex One (on-prem): SP1 CP Build 18012 (agent 14.0.0.17079)
- Apex One as a Service / Vision One SEP: Agent build 14.0.20731
Who Is Affected?
Full list of affected versions — see CVE-2026-34927. Apex One (on-prem) Server/Agent < 17079 and Apex One as a Service / Vision One SEP Agent < 14.0.20731.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
