Uncontrolled Search Path Vulnerability in Trend Micro Worry-Free Business Security Services

CVE-2025-49487

What is CVE-2025-49487?

An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could allow an attacker with physical access to the affected system to execute arbitrary code. This vulnerability is specific to the SaaS client version of WFBSS and does not impact the on-premise version. The security issue is primarily due to the need for physical access to a specific hardware component. Trend Micro has resolved this issue in prior maintenance updates, requiring no additional action from customers who keep their WFBSS agents updated within the regular SaaS maintenance deployment schedule.

References