What is the CVSS score of CVE-2025-49155?

CVE-2025-49155 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Trend Micro are affected by CVE-2025-49155?

CVE-2025-49155 is a high-severity remote code execution vulnerability in Trend Micro Apex One's DLP module that allows unauthenticated attackers to execute arbitrary code with user interaction,…. A patch is available.

How to fix or mitigate CVE-2025-49155?

Within 24 hours: Identify all systems running Trend Micro Apex One and document current versions in use. Within 7 days: Apply vendor-released patch to all Apex One installations; contact Trend Micro support for exact patched version number if not yet identified. Within 30 days: Conduct post-patch validation across a representative sample of endpoints and review DLP module logs for indicators of exploitation attempts during the patching window.

Trend Micro CVE-2025-49155

EUVD-2025-18530 HIGH

Uncontrolled Search Path Element (CWE-427)

2025-06-17 security@trendmicro.com

RCE Trend Micro Code Injection Path Traversal Apex One

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

14.0.0.14002,14.0.14492

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18530

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 19:15 nvd

HIGH 8.8

DescriptionCVE.org

An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.

AnalysisAI

CVE-2025-49155 is an uncontrolled search path vulnerability in Trend Micro Apex One's Data Loss Prevention (DLP) module that allows unauthenticated remote attackers to inject and execute arbitrary code. The vulnerability requires user interaction (CVSS UI:R) but poses critical risk to organizations deploying Apex One, as successful exploitation grants full system compromise with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation likelihood should be assessed against current threat intelligence for active in-the-wild usage.

Technical ContextAI

The vulnerability stems from CWE-427 (Uncontrolled Search Path Element), a path traversal/search path injection flaw where the Apex One DLP module fails to properly validate or sanitize the search path used for loading libraries or executable code. This class of vulnerability typically occurs when an application dynamically constructs file paths without proper canonicalization or validation, allowing attackers to inject relative paths, symbolic links, or malicious library names that the system will load from an attacker-controlled location. In the context of Trend Micro Apex One (Enterprise security/endpoint protection platform running on Windows/Linux systems), the DLP module likely uses dynamic loading mechanisms or search procedures that can be redirected to load attacker-supplied malicious code, bypassing intended security boundaries. The vulnerability is remotely triggerable (AV:N) with low attack complexity (AC:L), suggesting the search path injection can be triggered through network-accessible interfaces without complex exploit conditions.

RemediationAI

Immediate actions: (1) Consult Trend Micro official security advisory for CVE-2025-49155 (search Trend Micro Security Bulletin or Apex One release notes). (2) Apply the latest security patch for Apex One DLP module when released by Trend Micro. (3) Interim mitigations while patches are unavailable: restrict network access to Apex One administrative interfaces, disable DLP module if operationally feasible, monitor for suspicious library loading patterns or unexpected code execution. (4) Isolate or monitor systems with Apex One in high-risk environments (where users interact with external content). (5) Review Trend Micro's official patch documentation for deployment guidance, compatibility notes, and rollback procedures. Specific patch version and download links will be provided in vendor advisory (expected format: Apex One patch version X.X.X or hotfix).