CVE-2025-49155

State: Published
Severity: 8.8 High
Published: Jun 17, 2025
Updated: Jun 17, 2025
Reserved: Jun 2, 2025

Description

An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	trendmicro

Weaknesses

CWE-427 Uncontrolled Search Path Element

Affected Products

Product	Versions
Trend Micro Apex OneTrend Micro, Inc.	2019 (14.0) to before 14.0.0.14002Affected
Trend Micro Apex One as a ServiceTrend Micro, Inc.	SaaS to before 14.0.14492Affected

References

https://success.trendmicro.com/en-US/solution/KA-0019917
https://www.zerodayinitiative.com/advisories/ZDI-25-362/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.