Trend Micro Cleaner One Pro: File Cleanup Turns Into a…

A vulnerability in the Junk Files Cleanup component of Trend Micro Cleaner One Pro allows a local attacker to delete arbitrary files with SYSTEM privileges.

On July 29, 2026, advisory ZDI-26-496 disclosed a vulnerability in the Junk Files Cleanup component of Trend Micro Cleaner One Pro. The flaw, tracked as CVE-2026-62660 with a CVSS score of 5.6, allows an attacker with low-privileged code execution to delete arbitrary files in the SYSTEM context.

The coordinated disclosure follows a vendor report dated March 31, 2026. Trend Micro released a corrective update by July 29, 2026. The ZDI advisory does not specify which product versions were affected, nor the technical details of the distributed patch.

Key Takeaways

Vulnerability CVE-2026-62660 affects the Junk Files Cleanup component of Trend Micro Cleaner One Pro and enables arbitrary file deletion with SYSTEM privileges.
The attack technique exploits an NTFS junction (reparse point) to redirect the cleanup service to unintended paths, according to advisory ZDI-26-496.
The attacker must already have low-privileged code execution on the target system: this is not an initial access vector but an impact escalation.
Trend Micro released an update by July 29, 2026; the CVE-2026-62660 record is reserved at the CNA but not yet populated with technical details.

"This vulnerability allows local attackers to delete arbitrary files on affected installations of Trend Micro Cleaner One Pro. An attacker can leverage this vulnerability to delete files in the context of SYSTEM." — Advisory ZDI-26-496

What the Advisory Says: Documented Facts

The Cleaner One Pro Junk Files Cleanup service operates with SYSTEM privileges to remove temporary and residual files. According to advisory ZDI-26-496, "by creating a junction, an attacker can abuse the service to delete arbitrary files."

A junction is a type of NTFS reparse point that redirects a directory path to another location. The attacker, already in possession of low-privileged code, can create it in a controlled directory. The cleanup service, executing in the SYSTEM context, follows the junction and applies the deletion operation to the redirected destination.

Advisory ZDI-26-496 specifies the prerequisite: "An attacker must first obtain the ability to execute low-privileged code on the target system." The impact is limited to file deletion; arbitrary code execution or other post-exploitation techniques are not documented.

Analysis: The System Utility Paradox

Case ZDI-26-496 illustrates a recurring pattern: utilities designed to operate on protected directories, when they automatically elevate privileges, expand the attack surface if path resolution does not validate the presence of reparse points.

The CVSS 5.6 score correctly reflects the attack prerequisites: local access, pre-existing low-privileged code, impact limited to system confidentiality and integrity. The CVSS 3.x framework measures the severity of the documented vector, not hypothetical impact scenarios.

Arbitrary deletion in the SYSTEM context remains a significant impact on system availability. The ZDI advisory does not document, however, impact cascades or subsequent exploitation techniques; any assessment beyond file deletion constitutes inference unsupported by the primary source.

What to Do Now

Trend Micro Cleaner One Pro users must verify installation of the update released by July 29, 2026. Advisory ZDI-26-496 confirms that "Trend Micro has issued an update to correct this vulnerability," but does not provide a version identifier or direct patch URL.

To verify update status: access the Cleaner One Pro interface, check the dedicated updates section, and confirm no obsolete version warnings are present. If in doubt, contact Trend Micro support with explicit reference to CVE-2026-62660.

Organizations managing multiple endpoints should include this CVE in software inventory checks, limiting verification to product presence and update status. No alternative mitigations or temporary workarounds are documented in the brief.

Limits of Available Sources

This article relies on a single structured primary source: advisory ZDI-26-496 published by Zero Day Initiative. The CVE-2026-62660 record at cve.org is in "Reserved" status and provides no additional technical details. The Trend Micro corporate site contains no specific information on the vulnerability.

Elements not documented in the primary source: exact affected versions, full CVSS vector, patch technical details, presence of public exploit, number of potentially exposed installations, identity of the reporting researcher. Any information not explicitly attributed to ZDI-26-496 is not verifiable.

The documented timeline is: vendor notification on March 31, 2026, coordinated public release on July 29, 2026. The coordinated disclosure period is approximately 120 days, consistent with ZDI practice.

Editorial Close

Vulnerability ZDI-26-496 confirms that even seemingly mundane operations — temporary file deletion — require rigorous validation when executed with elevated privileges. The case is not a disruptive remote exploit, but a reminder: the security perimeter includes daily maintenance services, and their compromise can degrade system integrity without requiring privileged initial access.

The risk measure remains the CVSS 5.6 assigned by ZDI: medium severity, local prerequisites, documented impact on integrity and availability. The update released by Trend Micro closes the known vector; verification of its application is the recommended and verifiable action.

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references