ZDI-26-653: TrendAI Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of

Zerodayinitiative • September 10, 2026

This vulnerability allows local attackers to escalate privileges on affected installations of TrendAI Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the cache mechanism. The issue results from the lack of proper cache key checking during signature verification. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.

TrendAI has issued an update to correct this vulnerability. More details can be found at:

2025-10-29 - Vulnerability reported to vendor

2026-09-10 - Coordinated public release of advisory

2026-09-10 - Advisory Updated

Lays (@_L4ys) of TRAPA Security

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in TrendAI Apex One Security Agent Allow Local Privilege Escalation Three vulnerabilities have been identified in TrendAI Apex One Security Agent, allowing local attackers to escalate privileges. The first two vulnerabilities (ZDI-26-652 and ZDI-26-653) are related to a flaw in the cache mechanism due to improper cache key checking during signature verification. The third vulnerability (ZDI-26-654) involves incomplete cleanup in the TmccCore component, leading to privilege escalation. Attackers must have low-privileged access to exploit these vulnerabilities. TrendAI has issued updates to address these issues. The vulnerabilities were reported to the vendor between October 2025 and January 2026, with public advisories released on September 10, 2026. 3 sources 57

Extracted Entities

ZDI-26-653: TrendAI Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)