Trend Micro CVE-2025-49155

The CVSS 8.8 score (High) reflects legitimate risk: network accessibility, low complexity, and complete system compromise potential. However, the User Interaction requirement (UI:R) is a meaningful constraint—the attack requires victim action, reducing autonomous worm potential. The attack vector (AV:N) and low complexity (AC:L) indicate this is readily exploitable once triggered. Without confirmed EPSS data or public POC references, assess real-world priority as HIGH for organizations running Apex One in environments where users interact with potentially untrusted content (email, web, file shares). The lack of privilege requirements (PR:N) means any network user can attempt the attack. This is a genuine priority: network-accessible, low-complexity code execution with high impact justifies immediate patching. Organizations should prioritize this above cosmetic or low-complexity-to-exploit CVEs, but the UI requirement means this is not an immediate worm/mass-exploitation vector like network-accessible RCE without user interaction.

An attacker crafts a malicious payload or specially-formed request targeting a network-accessible Apex One DLP interface (e.g., policy management, quarantine system, or logging service). The payload exploits the uncontrolled search path by injecting a relative path or environment variable that causes the DLP module to load a malicious library or executable from an attacker-controlled location (e.g., a network share, temporary directory, or current working directory). When a user or administrator interacts with the Apex One system (triggering the DLP module), the injected code executes with the privileges of the Apex One process (often SYSTEM or root on endpoints). This results in complete system compromise, allowing the attacker to exfiltrate data, install backdoors, disable security controls, or pivot laterally within the organization. Example: attacker sends email with malicious attachment; victim opens it; Apex One DLP scans it and invokes vulnerable search-path-based library loading; attacker's injected path resolves to pre-staged malicious DLL on the system; arbitrary code execution occurs. No public POC is referenced in the CVE description, but the low attack complexity suggests POC development would be straightforward once the vulnerability is disclosed.