What is the CVSS score of CVE-2025-49157?

CVE-2025-49157 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Trend Micro are affected by CVE-2025-49157?

CVE-2025-49157 is a privilege escalation vulnerability in Trend Micro Apex One that allows attackers with low-privilege code execution to gain higher system privileges through improper link following…. A patch is available.

How to fix or mitigate CVE-2025-49157?

Within 24 hours: Inventory all endpoints running Trend Micro Apex One and confirm current version. Within 7 days: Obtain the patched version from Trend Micro advisory and test in staging environment. Within 30 days: Deploy patched version across all Apex One installations; prioritize systems handling sensitive data or critical business functions.

Trend Micro CVE-2025-49157

EUVD-2025-18528 HIGH

Improper Privilege Management (CWE-269)

2025-06-17 security@trendmicro.com

Privilege Escalation Trend Micro Apex One

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

14.0.14492,14.0.0.14002

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18528

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 19:15 nvd

HIGH 7.8

DescriptionCVE.org

A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

AnalysisAI

Privilege escalation vulnerability in Trend Micro Apex One's Damage Cleanup Engine that exploits improper link following (CWE-269), allowing local attackers with low-privilege code execution to escalate to higher privileges. The vulnerability requires initial code execution on the target system but presents significant risk due to its high CVSS score (7.8) and likely real-world exploitability given the common prevalence of local code execution vectors in enterprise environments.

Technical ContextAI

This vulnerability resides in the Trend Micro Apex One Damage Cleanup Engine, a component responsible for remediating malware-related system damage. The root cause is classified as CWE-269 (Improper Access Control / Failure to Use Least Privilege), manifesting as a link-following vulnerability that likely exploits symlink or junction point attacks on the Windows filesystem. The Damage Cleanup Engine operates with elevated privileges to repair system-level infections, but fails to validate symbolic links or implement proper privilege boundary checks when accessing files or directories during cleanup operations. An attacker with low-privileged execution context (such as a standard user account or sandboxed process) can craft malicious links pointing to sensitive system files or registry locations, causing the high-privileged engine to perform unauthorized operations, thereby achieving privilege escalation.

RemediationAI

Remediation steps: (1) Apply the latest security patch from Trend Micro for Apex One addressing CVE-2025-49157—consult Trend Micro's Security Advisory website for version-specific patches; (2) Prioritize patching in environments where standard user accounts or service accounts have local code execution risk (e.g., systems exposed to untrusted code execution, web servers, development systems); (3) Implement Windows security hardening: disable unnecessary symbolic link creation via Group Policy (secedit.exe or Group Policy Editor), restrict SeCreateSymbolicLinkPrivilege, and enforce File Integrity Monitoring (FIM) on sensitive system directories; (4) Temporarily mitigate by restricting low-privilege account execution contexts if operationally feasible; (5) Monitor Trend Micro's advisory pages for patch release dates and compatibility notes. Contact Trend Micro support for guidance on patching timelines if immediate patching is not possible.