CVE-2025-49156: Trend Micro Apex One Privilege Escalation

CVE-2025-49156 Overview

CVE-2025-49156 is a link following vulnerability in the Trend Micro Apex One scan engine. The flaw allows a local, low-privileged attacker to escalate privileges on affected Windows installations. The vulnerability is tracked under [CWE-59] (Improper Link Resolution Before File Access) and [CWE-269] (Improper Privilege Management).

Exploitation requires the attacker to first execute low-privileged code on the target system. Once that foothold exists, the attacker can abuse how the scan engine follows filesystem links to perform privileged file operations. Trend Micro published a solution guide addressing the flaw, and the Zero Day Initiative issued advisory ZDI-25-363.

Critical Impact
A local attacker with low-privileged code execution can escalate to SYSTEM-level privileges on Windows endpoints running vulnerable Apex One installations.

Affected Products

Trend Micro Apex One (on-premises) on Windows
Trend Micro Apex One as a Service (SaaS) on Windows
Trend Micro Apex One scan engine component

Discovery Timeline

2025-06-17 - CVE-2025-49156 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49156

Vulnerability Analysis

The vulnerability resides in the Trend Micro Apex One scan engine, a component that runs with elevated privileges to inspect files across the filesystem. The scan engine follows filesystem links without adequately validating the link target or verifying that the resolved path is safe for the operating context.

Because the scan engine executes with high privileges while acting on paths controllable by a low-privileged local user, an attacker can redirect privileged file operations. This class of flaw commonly enables arbitrary file write, arbitrary file delete, or DACL manipulation, which attackers convert into full local privilege escalation. The Zero Day Initiative documents the issue in ZDI-25-363.

Root Cause

The root cause is improper link resolution before file access [CWE-59] combined with improper privilege management [CWE-269]. The scan engine performs privileged file operations on paths that a local attacker can influence with symbolic links, junctions, or hard links. The engine resolves the link at the time of use rather than validating the target under the caller's security context.

Attack Vector

The attack vector is local. An attacker must already run code as a low-privileged user on the target Windows host. The attacker then plants a filesystem link, such as a symbolic link, mount point, or hard link, that redirects a file operation performed by the scan engine into a location the attacker could not otherwise modify.

When the privileged scan engine acts on the attacker-controlled path, it writes, reads, or deletes files as SYSTEM. The attacker chains this primitive into code execution as SYSTEM, achieving full local privilege escalation on the endpoint.

No verified public proof-of-concept code is available. See the Zero Day Initiative Advisory ZDI-25-363 for additional technical context.

Detection Methods for CVE-2025-49156

Indicators of Compromise

Creation of symbolic links, junctions, or hard links in directories that the Apex One scan engine reads or writes to during scans.
Unexpected file writes or deletions in privileged directories such as C:\Windows\System32 or C:\Program Files originating from Apex One scan engine processes.
New service binaries, scheduled tasks, or DLLs appearing shortly after scan engine activity from a low-privileged user session.

Detection Strategies

Monitor process lineage for Apex One scan engine processes performing file operations on paths outside their expected working directories.
Alert on CreateSymbolicLink, CreateHardLink, or reparse-point creation by non-administrative users targeting Trend Micro directories.
Correlate low-privileged process activity with subsequent SYSTEM-context file writes to catch link-following abuse.

Monitoring Recommendations

Enable Windows Sysmon Event IDs 11 (FileCreate) and 15 (FileCreateStreamHash) on hosts running Apex One and forward to your SIEM.
Track modifications to Apex One installation directories and quarantine paths for unexpected link objects.
Baseline scan engine file I/O behavior and alert on deviations that could indicate link-following exploitation.

How to Mitigate CVE-2025-49156

Immediate Actions Required

Apply the patched Apex One build referenced in the Trend Micro Solution Guide KA-0019917 to all on-premises and SaaS-managed endpoints.
Inventory all Windows endpoints running Apex One and confirm the scan engine version matches the fixed release.
Restrict interactive and remote low-privileged access on servers running Apex One until patching is complete.

Patch Information

Trend Micro has released fixed versions of Apex One and updated scan engine components. Refer to the Trend Micro Solution Guide KA-0019917 for the exact fixed builds, deployment instructions, and SaaS rollout status. Apex One as a Service tenants receive the fix through the Trend Micro-managed update channel.

Workarounds

Limit local logon rights on hosts running Apex One to reduce the population of users able to stage link-following attacks.
Enforce application allowlisting to block execution of untrusted low-privileged binaries that could plant malicious links.
Audit and remove existing symbolic link creation privileges (SeCreateSymbolicLinkPrivilege) from standard user accounts where not required.

bash

# Configuration example: audit SeCreateSymbolicLinkPrivilege assignment on Windows
# Run in an elevated PowerShell session
secedit /export /cfg C:\temp\secpol.cfg
Select-String -Path C:\temp\secpol.cfg -Pattern "SeCreateSymbolicLinkPrivilege"

# Remove the privilege from non-administrative accounts via Group Policy:
# Computer Configuration > Windows Settings > Security Settings >
#   Local Policies > User Rights Assignment > "Create symbolic links"