Trend Micro's TrendLife VPN product has been found to contain a local privilege escalation vulnerability, tracked as CVE-2026-67212, which could allow an attacker to execute arbitrary code with SYSTEM privileges. The flaw, identified as ZDI-26-577 (ZDI-CAN-29830), stems from an uncontrolled search path element in the OpenSSL configuration used by the VPN client.
The vulnerability has a CVSS score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a high severity. Exploitation requires an attacker to first gain the ability to execute low-privileged code on the target system. Once this initial access is established, the attacker can leverage the insecure loading of OpenSSL configuration files to escalate their privileges.
Specifically, the product loads its configuration from an unsecured location, which an attacker can manipulate. By placing malicious configuration files in this accessible location, an attacker can trick the VPN client into executing arbitrary code in the context of the highly privileged SYSTEM user.
The vulnerability was reported to Trend Micro on April 16, 2026, by researcher Xavier DANEST. A coordinated public release of the advisory occurred on August 13, 2026, the same day Trend Micro issued an update to address the flaw.
Trend Micro has confirmed the vulnerability and released an update to correct it. Users of TrendLife VPN are advised to apply the latest updates immediately to mitigate the risk. Further details and remediation instructions are available on the Trend Micro help center website under article TMKA-13331.
