ZDI-26-577: Trend Micro VPN OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
ZDI disclosed a local privilege escalation (CVE-2026-67212, CVSS 7.0) in Trend Micro VPN's OpenSSL configuration, requiring prior low-privileged code execution.
The Zero Day Initiative published advisory ZDI-26-577 describing an uncontrolled search path element vulnerability in Trend Micro VPN's OpenSSL configuration. Local attackers who can already execute low-privileged code on an affected installation can escalate privileges. ZDI rated the issue 7.0 on CVSS and assigned CVE-2026-67212.
- Local privilege escalation in Trend Micro VPN via OpenSSL configuration search path.
- Requires prior execution of low-privileged code on the target.
- CVSS 7.0; tracked as CVE-2026-67212 under ZDI-26-577.
- CVEs
- CVE-2026-67212
- Products
- Trend Micro VPN
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-67212 | — | — | — |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro VPN. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.