What is the CVSS score of CVE-2025-49156?

CVE-2025-49156 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Trend Micro are affected by CVE-2025-49156?

Trend Micro Apex One contains a high-severity privilege escalation vulnerability (CVE-2025-49156) in its scan engine that allows attackers with low-level system access to elevate privileges.. A patch is available.

How to fix or mitigate CVE-2025-49156?

Within 24 hours: Identify all systems running Trend Micro Apex One and obtain the current installed version from inventory. Within 7 days: Test the available vendor patch in a staging environment matching production configurations, then deploy to non-critical systems. Within 30 days: Complete deployment of the available patch to all production Apex One installations and verify patch application across the environment.

Trend Micro CVE-2025-49156

EUVD-2025-18529 HIGH

Improper Privilege Management (CWE-269)

2025-06-17 security@trendmicro.com

Privilege Escalation Trend Micro Apex One

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

14.0.0.14002,14.0.14492

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18529

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 19:15 nvd

HIGH 7.0

DescriptionCVE.org

A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

AnalysisAI

Privilege escalation vulnerability in Trend Micro Apex One's scan engine that exploits improper link handling to allow local attackers to escalate privileges. The vulnerability affects Trend Micro Apex One installations and requires an attacker to first obtain low-privileged code execution on the target system. While no active exploitation in the wild has been confirmed at this time, the CVSS score of 7.0 indicates a high-severity local privilege escalation risk for organizations running vulnerable versions.

Technical ContextAI

This vulnerability exists in Trend Micro Apex One's scan engine and is classified as a link following vulnerability (CWE-269: Improper Access Control - Generic). CWE-269 indicates that the vulnerability stems from inadequate access control mechanisms that fail to properly restrict operations or resources. In this context, the scan engine likely follows symbolic links or hard links without proper validation of the target's ownership, permissions, or path integrity, allowing an unprivileged user to redirect file operations to sensitive system resources or files owned by the scanner process (typically running with higher privileges). The attack leverages the trust relationship between the scan engine and file system operations, where the engine's higher privilege level is exploited through improper link dereferencing.

RemediationAI

Contact Trend Micro directly or review their official security advisory for CVE-2025-49156 to obtain the specific patched version. 2. Apply the vendor-provided patch to all Trend Micro Apex One installations as soon as possible. 3. Until patching is possible, implement compensating controls: (a) Restrict local user account creation and low-privileged account access on systems running Apex One; (b) Use file system monitoring to detect suspicious symbolic link creation in scan engine working directories; (c) Implement application whitelisting to restrict code execution from untrusted sources, reducing initial code execution risk. 4. Disable or isolate Apex One instances in high-risk environments until patches are deployed. 5. Monitor Trend Micro's security portal for updated CVE documentation, patch availability, and any indicators of active exploitation.