CVE-2023-47192 is a high severity local privilege escalation in the Trend Micro Apex One security agent, scored 7.8. A link following flaw in the RealTime Scan service can give SYSTEM access to someone who already runs code on the machine. Apply Apex One SP1 Critical Patch 12526 or the September 2023 monthly patch for the as a service edition.
What's affected
Trend Micro's security bulletin for Apex One, dated 6 November 2023, lists Apex One 2019 (on premises) and Apex One as a Service, both on Windows. The minimum fixed levels are Apex One Service Pack 1 Critical Patch 12526 for on premises installs, and the September 2023 monthly patch (202309) with agent version 14.0.12737 for the as a service edition. Trend Micro advises moving to the latest version if a newer one exists.
This entry is the agent link following issue, CVE-2023-47192. Per the Zero Day Initiative, the flaw is in the Apex One NT RealTime Scan service. By creating a junction, a local attacker can abuse the service to create arbitrary files, which leads to code execution as SYSTEM. The attacker first needs the ability to run low-privileged code on the machine.
Dates differ across sources, and it is worth knowing why. The Zero Day Initiative advisory ZDI-23-1611 was released on 14 November 2023, the bulletin is dated 6 November 2023, and the NVD record shows 23 January 2024. These are different events for the same issue, so do not read the NVD date as the date a fix appeared. Severity matches across sources, 7.8 High, with a local vector.
The NVD record was published on 2024-01-23, scores 7.8 (High), and carries the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Weakness class: CWE-59.
How to check if you're exposed
Apex One agents and the management server are managed from the console, so the check is a version comparison, not a command.
- Open the Apex One management console and review the version of the management server and the agents.
- For on premises installs, confirm that Service Pack 1 Critical Patch 12526 or later is applied, using the readme linked from Trend Micro's bulletin.
- For Apex One as a Service, confirm the agent version is 14.0.12737 or later and the September 2023 monthly patch is in place.
- Sort agents by version and find the machines that are behind, especially shared workstations and servers.
On Windows hosts where several people can sign in, the risk is higher. Pay extra attention to terminal servers and shared lab machines.
What to do now
- Read Trend Micro's bulletin and note the minimum patch for your edition.
- Apply the patch to the management server first, then deploy updated agents.
- Find agents that did not update, such as machines that are offline or excluded from policy, and bring them current.
- Test the new self protection behavior. Trend Micro warns that apps not signed by Trend Micro or Microsoft that inject into other processes may be blocked, so add exceptions for trusted tools through the documented process.
- Review who can run code as a standard user on important machines, since every attack in this family starts there.
Why it matters
Link following is a classic weakness in software that runs as SYSTEM and touches files in places a standard user can influence. Windows junctions let a user point a folder at another location. If a privileged service follows the junction without checking, its file operations land somewhere the user chose.
The weakness is CWE-59, improper link resolution before file access. The fix has to come from the vendor, since the service itself must stop following untrusted links. Customers cannot reliably block it with permissions alone, though limiting who can create junctions on sensitive volumes helps.
Trend Micro lists this CVE separately from a group of origin validation issues. Treat them together in your patch plan, because one patch level covers all eleven CVEs in the bulletin. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Is this remotely exploitable?
No. The vector is local and the attacker must already be able to run low-privileged code on the machine.
Sources
Last reviewed: 19 October 2026.
