TrendAI Vision One and the 'Historical' CVE-2025-71387: Patched…

Trend Micro published bulletin KA-0023937 for CVE-2025-71387, a privilege escalation vulnerability in TrendAI Vision One that was already fixed in the December 2025 monthly update.

On July 29, 2026, the Zero Day Initiative published advisory ZDI-26-498 covering a privilege escalation vulnerability in the TrendAI Vision One Service Gateway, tracked as CVE-2025-71387. The flaw had already been fixed in the December 2025 monthly update, ten months after the initial report on October 3, 2025. The Trend Micro vendor bulletin, dated July 21, 2026, is explicitly classified as "information only": no action is required for customers who update regularly.

Key Takeaways

CVE-2025-71387 allows an authenticated remote attacker to escalate privileges in the TrendAI Vision One Service Gateway registration process.
The CVSS v3.1 score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) at the time of initial reporting, with high privileges required for exploitation.
The fix was delivered in the December 2025 monthly update; the ZDI advisory was released on July 29, 2026, roughly seven months after the patch.
Trend Micro classifies bulletin KA-0023937 as "information only" and confirms no action is needed for customers on regular maintenance.

The Mechanism: Incorrect Privilege Assignment in Service Gateway Registration

The flaw lies in the handling of the TrendAI Vision One Service Gateway registration. According to the ZDI advisory, "the specific flaw exists within the handling of Service Gateway registration. The issue results from incorrect privilege assignment." An authenticated remote attacker can exploit this misassignment to gain higher privileges than originally granted.

Authentication is a prerequisite. The advisory states: "Authentication is required to exploit this vulnerability." This constraint reduces the attack surface compared to a credential-less vulnerability, but does not eliminate risk in enterprise environments where compromised accounts or insiders are plausible vectors.

The vendor bulletin describes the vulnerability as allowing "a user with certain key roles to elevate their privileges." The dossier does not specify exactly which "certain key roles" these are, nor the precise level of privileges obtainable post-exploitation.

The Disclosure Timeline: From October 2025 to July 2026

The chronology reveals an extended coordinated disclosure process. Researcher Xavier DANEST of Decathlon, working with the TrendAI Zero Day Initiative, reported the vulnerability on October 3, 2025. Trend Micro released the fix in the December 2025 monthly update. The vendor bulletin is dated July 21, 2026. The ZDI advisory was published on July 29, 2026.

This roughly ten-month gap between report and public advisory, with a seven-month lag between patch and coordinated disclosure, raises questions about risk perception management. Trend Micro opted for an "information only bulletin," a practice that documents the vulnerability for researcher acknowledgement and CVE assignment but explicitly rules out operational urgency.

"This bulletin is provided as an INFORMATION ONLY BULLETIN – meaning that the issues outlined in this bulletin are historical and are for the purposes of researcher acknowledgement and CVE documentation." — Trend Micro Bulletin KA-0023937

The "Information Only" Model: Risk Management or Perception Attenuation?

The decision to classify the bulletin as "information only" is technically sound: the vulnerability is already resolved. However, this vendor practice warrants critical reading. The ZDI advisory and the Trend Micro bulletin converge in framing CVE-2025-71387 as a historical fact, not a current threat. This framing has operational consequences.

For security teams, an "information only bulletin" can create ambiguity. Patching priority is set by the vendor itself, which in this case excludes it. Yet verification that the December 2025 update was actually applied remains the customer's responsibility. The dossier does not document whether Trend Micro actively notified unpatched customers or whether the ZDI advisory represents the first public disclosure channel for users who may have missed the patch.

The CVE-2025-71387 record on cve.org remains in reserved status, lacking populated technical details at the time of writing. This gap between CVE assignment and public record population is common, but highlights how official enterprise vulnerability documentation often proceeds in incomplete stages.

What to Do Now

Verify that the TrendAI Vision One environment has been updated with the December 2025 monthly maintenance or later.
Check Service Gateway registration logs for anomalies in the pre-patch period (October–December 2025) if retention allows.
Review role assignments for users with access to the Service Gateway, given that exploitation requires specific privileges not fully detailed in the dossier.
Monitor the population of the CVE-2025-71387 record on cve.org for potential updates to the CVSS vector or specific affected versions.

The Lesson of the Lag: When Disclosure Becomes Second-Tier Communication

The CVE-2025-71387 episode illustrates a structural tension in enterprise cybersecurity. The timely fix in December 2025 is indisputable; the advisory publication in July 2026, with its "information only" classification, turns a technical vulnerability into a managed communication event. Researcher acknowledgement, CVE assignment, and historical documentation are achieved, but operational transparency — immediate risk visibility for those who don't update — is deferred and attenuated.

For the industry, the question is not the legitimacy of the "information only" model, but its systemic adoption. If enterprise vendors adopt this classification as standard for already-patched vulnerabilities, security teams must build independent verification processes rather than delegating priority to the vendor's communication framing. The TrendAI Vision One case is a telling example of how "security bureaucracy" — disclosure timelines, bulletin labels, CVE population — concretely influences risk management more than the technical nature of the flaw itself.

Frequently Asked Questions

Why was the advisory published in July 2026 if the patch is from December 2025?

July 29, 2026 is the coordinated release date of the ZDI advisory, which follows the vendor bulletin of July 21, 2026. Trend Micro manages disclosure so the public advisory arrives after patch distribution, but the seven-month lag between fix and public documentation is not explained in detail in the dossier.

Is the CVSS 7.2 still valid?

The Trend Micro bulletin specifies that the CVSS 3.1 score of 7.2 is "at time of initial report." The dossier contains no subsequent updates to the score, nor confirmation that it was reassessed after the patch release.

Which specific TrendAI Vision One versions are affected?

The dossier does not list specific affected software versions. The ZDI advisory refers generically to "affected installations of TrendAI Vision One," while the vendor bulletin states the vulnerability was fixed in the December 2025 monthly update without detailed build numbers.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references