Uncontrolled Search Path Vulnerability in Trend Micro Apex One Data Loss Prevention Module
CVE-2025-49155

8.8HIGH

Key Information:

Vendor

Trend Micro
Status
Trend Micro Apex One
Trend Micro Apex One As A Service
Vendor
CVE Published:
17 June 2025

What is CVE-2025-49155?

An uncontrolled search path vulnerability exists in the Trend Micro Apex One Data Loss Prevention module, which can be exploited by attackers to inject malicious code. This poses a serious risk of arbitrary code execution on installations of the affected module, potentially allowing unauthorized access and manipulation of system data.

Affected Version(s)

Trend Micro Apex One 2019 (14.0) < 14.0.0.14002

Trend Micro Apex One as a Service SaaS < 14.0.14492

References

https://success.trendmicro.com/en-US/solution/KA-0019917
https://www.zerodayinitiative.com/advisories/ZDI-25-362/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-49155 : Uncontrolled Search Path Vulnerability in Trend Micro Apex One Data Loss Prevention Module