What is the CVSS score of CVE-2025-49154?

CVE-2025-49154 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Trend Micro are affected by CVE-2025-49154?

CVE-2025-49154 is a high-severity access control flaw in Trend Micro Apex One and Worry-Free Business Security that permits local attackers with existing code execution to overwrite critical system…. A patch is available.

How to fix or mitigate CVE-2025-49154?

Within 24 hours: Identify all Trend Micro Apex One and Worry-Free Business Security deployments in your environment and document current versions. Within 7 days: Apply the vendor-released patch to all affected systems, prioritizing production and high-value endpoints. Within 30 days: Complete patch verification through automated compliance scanning and validate that all systems have successfully updated.

Trend Micro CVE-2025-49154

EUVD-2025-18531 HIGH

Improper Access Control (CWE-284)

2025-06-17 security@trendmicro.com

Trend Micro Privilege Escalation Information Disclosure Worry Free Business Security Worry Free Business Security Services Apex One

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2514,14.0.0.14002,14.0.14492

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18531

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 19:15 nvd

HIGH 8.7

DescriptionCVE.org

An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

AnalysisAI

CVE-2025-49154 is an insecure access control vulnerability (CWE-284) in Trend Micro Apex One and Worry-Free Business Security that allows a local attacker with low-privileged code execution to overwrite critical memory-mapped files, potentially compromising system security and stability. With a CVSS score of 8.7 and low attack complexity, this vulnerability poses a significant risk to enterprise security postures, though exploitation requires prior code execution access. No active KEV confirmation or public POC availability is documented in standard vulnerability databases at this time.

Technical ContextAI

This vulnerability stems from improper access control mechanisms protecting memory-mapped files used by Trend Micro's endpoint security solutions. Memory-mapped files are a Windows mechanism where file contents are mapped directly into process address space, often used for inter-process communication and shared data access. CWE-284 (Improper Access Control - Permissions, Privileges, and Other Access Controls) indicates that Trend Micro Apex One and Worry-Free Business Security fail to properly restrict write access to these critical security-sensitive files. The affected technology involves kernel-level or privileged service components that should restrict file modification to authenticated, high-privileged contexts but instead allow low-privileged local processes to modify them. This likely affects security decision-making files, configuration stores, or threat intelligence caches that the security software relies upon for protection mechanisms.

RemediationAI

Patch Management: Apply the latest security updates from Trend Micro for both Apex One and Worry-Free Business Security as released in their official security advisories. Consult Trend Micro's security bulletin portal for specific patch versions and release dates. Workarounds: (1) Restrict local code execution privileges using Windows AppLocker, Software Restriction Policies, or third-party endpoint application control to prevent low-privileged attackers from executing arbitrary code; (2) Run user applications in sandboxed or containerized environments; (3) Implement strict principle-of-least-privilege for user accounts. Monitoring: Enable audit logging on file access to memory-mapped security files and monitor for unauthorized modification attempts. Post-remediation verification should confirm that file permissions on critical Trend Micro-managed files (typically in C:\Program Files\Trend Micro\ or AppData directories) are properly restricted.