CVE-2025-49157: Trend Micro Apex One Privilege Escalation

CVE-2025-49157 Overview

CVE-2025-49157 is a link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine. The flaw allows a local, low-privileged attacker to escalate privileges on affected Windows installations. Exploitation abuses how the engine follows filesystem links, enabling an attacker to redirect privileged file operations to attacker-controlled targets. The weakness is tracked under CWE-59 (Link Following) and CWE-269 (Improper Privilege Management). An attacker must already be able to execute low-privileged code on the target system to exploit this issue.

Critical Impact
Successful exploitation grants SYSTEM-level privileges on Windows hosts running vulnerable Apex One agents, giving full control over confidentiality, integrity, and availability.

Affected Products

Trend Micro Apex One (on-premises, Windows)
Trend Micro Apex One as a Service (SaaS, Windows)
Trend Micro Apex One Damage Cleanup Engine component

Discovery Timeline

2025-06-17 - CVE-2025-49157 published to the National Vulnerability Database
2025-06-17 - Trend Micro publishes solution guide KA-0019917
2025-06-17 - Zero Day Initiative publishes advisory ZDI-25-364
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49157

Vulnerability Analysis

The Damage Cleanup Engine is a privileged component of Trend Micro Apex One responsible for remediating malware artifacts on Windows endpoints. It performs file operations, including create, write, and delete actions, in the SYSTEM security context. A local attacker who can run code at standard user privilege can influence the paths the engine touches by planting filesystem links before those operations execute.

Because the engine does not adequately validate whether target paths resolve to symbolic links, junctions, or hard links controlled by an unprivileged user, its privileged file operations can be redirected. The result is arbitrary file write, overwrite, or deletion as SYSTEM, which is a well-established primitive for local privilege escalation on Windows.

Root Cause

The root cause is improper resolution of links before privileged filesystem access (CWE-59). The Damage Cleanup Engine trusts paths under directories where low-privileged users can create NTFS junctions or object manager symbolic links. Combined with improper privilege management (CWE-269), the engine performs high-privilege operations on user-controllable targets without opening handles in a link-safe manner.

Attack Vector

Exploitation requires local access and prior low-privileged code execution. The attacker stages a link, for example a mount point or object manager symbolic link, that redirects a path the Damage Cleanup Engine writes to or deletes. When the engine runs, it follows the link and performs its action against an attacker-chosen target such as a protected DLL, service binary, or scheduled task file. Overwriting or hijacking that target yields SYSTEM code execution. No user interaction and no network access are required. See the ZDI-25-364 advisory for further technical context.

Detection Methods for CVE-2025-49157

Indicators of Compromise

Creation of NTFS junctions, hard links, or object manager symbolic links inside directories written to by Apex One agent processes.
Unexpected file writes or deletions performed by Damage Cleanup Engine binaries against paths outside their normal working directories.
New or modified services, scheduled tasks, or DLLs in privileged locations shortly after Damage Cleanup Engine activity.
Local user accounts spawning cmd.exe, powershell.exe, or code with SYSTEM integrity following Apex One remediation events.

Detection Strategies

Monitor process lineage of Apex One Damage Cleanup Engine components for child processes running as SYSTEM that are not part of documented Trend Micro behavior.
Alert on low-privileged processes creating reparse points or junctions inside directories subsequently accessed by Apex One services.
Correlate filesystem writes performed by Apex One processes against a baseline of expected paths, flagging deviations to system directories.

Monitoring Recommendations

Enable Windows Sysmon Event IDs 11 (FileCreate) and 15 (FileCreateStreamHash) with rules for reparse point creation in user-writable directories.
Ingest Apex One agent and server logs into a centralized SIEM or data lake and retain Damage Cleanup Engine event history for forensic review.
Track privilege transitions on endpoints, focusing on token elevations that originate from standard user sessions.

How to Mitigate CVE-2025-49157

Immediate Actions Required

Apply the vendor-supplied Apex One update referenced in the Trend Micro solution guide KA-0019917 to all on-premises and SaaS-managed Windows agents.
Inventory endpoints running Apex One and confirm the Damage Cleanup Engine version matches the fixed release.
Restrict interactive and remote low-privileged access to servers and workstations hosting Apex One until patching is complete.
Review recent Damage Cleanup Engine activity on high-value systems for signs of link-based redirection.

Patch Information

Trend Micro has released fixed builds for both Apex One on-premises and Apex One as a Service. Refer to Trend Micro solution KA-0019917 for the specific patched versions, deployment steps, and applicability matrix. SaaS tenants receive the update through Trend Micro's managed rollout; on-premises administrators must deploy the updated Damage Cleanup Engine module through the Apex One management console.

Workarounds

No official workaround replaces the patch; Trend Micro recommends updating affected components as the primary remediation.
Limit which users can obtain local logon rights on protected Windows hosts to reduce the pool of accounts that can stage link attacks.
Enforce application control policies that block unsigned or unapproved binaries from executing in user-writable directories.

bash

# Configuration example: verify Apex One agent build on Windows endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion" /v ProgramVer