CVE-2023-52091 is a high severity (7.8 CVSS) local privilege escalation in the Trend Micro Apex One agent on Windows: a link following weakness in the anti-spyware engine. Trend Micro fixed it with Apex One 2019 SP1 Critical Patch b12534 and, for the SaaS edition, the November 2023 monthly patch with agent version 14.0.12849.
What's affected
Trend Micro's January 9, 2024 bulletin covers Apex One 2019 (on-premises) and Apex One as a Service (SaaS), both Windows and English builds. The NVD record lists the same two products.
- Apex One 2019 on-premises: fixed in SP1 Critical Patch b12534.
- Apex One as a Service: fixed in the November 2023 monthly patch (202311), agent version 14.0.12849.
Trend Micro asks customers to install any prerequisite service packs from its Download Center before applying the fix, and to move to the latest build if a newer one exists.
How to check if you're exposed
Trend Micro does not publish a one line detection command for this issue, so use the console. In the Apex One management console, review the agent versions and build numbers across your endpoints and compare them with the fixed builds above. Anything on an older Apex One 2019 build than SP1 Critical Patch b12534, or a SaaS agent older than 14.0.12849, should be treated as exposed.
Because the flaw is local, also ask which endpoints let untrusted or low-privileged users run code: shared workstations, jump hosts, and developer machines are the usual candidates.
What to do now
- Confirm which edition you run, on-premises Apex One 2019 or Apex One as a Service.
- Apply Apex One 2019 SP1 Critical Patch b12534, or confirm SaaS agents have reached 14.0.12849 or later.
- Install prerequisite service packs first, as the bulletin instructs.
- Review remote access to critical systems and confirm that policies and perimeter security are current, as Trend Micro recommends.
- Read the Trend Micro solution article for the final word on builds.
Why it matters
CVE-2023-52091 is a link following bug in the anti-spyware engine. Link following happens when a privileged process works on a file path without checking that an unprivileged user has not redirected it with a link. The process then acts on a location the attacker chose. The NVD record maps it to CWE-59, improper link resolution before file access. The score of 7.8 reflects a local attacker with low privileges and no user interaction who can reach high impact on confidentiality, integrity and availability.
Trend Micro states that an attacker must first be able to run low-privileged code on the endpoint. That makes this a second stage bug: it matters after phishing, a stolen low-privilege account, or a malicious package has already landed. The record's KEV flag is false, and the advisories we read do not claim exploitation in the wild. Security agents run with high privileges, which is why flaws in them are worth patching quickly even when the entry point is local.
For a wider view, the free in-browser dependency scan and the Gold directory help you see which packaged components in your own code carry known CVEs, and reachability analysis helps you decide which ones matter first.
Quick check
Does an attacker need to be on the network to use this?
No. The record shows a local attack vector. An attacker must already be able to run low-privileged code on the Windows endpoint.
Sources
Last reviewed: 19 October 2026.
