CVE-2025-49158: Trend Micro Apex One Privilege Escalation

CVE-2025-49158 Overview

CVE-2025-49158 is an uncontrolled search path vulnerability [CWE-427] in the Trend Micro Apex One security agent. The flaw allows a local attacker with low-privileged code execution to escalate privileges on affected Windows installations. Exploitation requires prior code execution on the target, but successful attacks compromise confidentiality, integrity, and availability.

The vulnerability affects both on-premises and SaaS deployments of Apex One on Windows. Trend Micro published fix guidance through Trend Micro Solution Article KA-0019917, and the Zero Day Initiative tracks the issue as ZDI-25-365.

Critical Impact
A local attacker with the ability to run low-privileged code can escalate to the SYSTEM context used by the Apex One agent, gaining full control of the endpoint.

Affected Products

Trend Micro Apex One (on-premises) for Windows
Trend Micro Apex One as a Service (SaaS) for Windows
Trend Micro Apex One security agent components

Discovery Timeline

2025-06-17 - CVE-2025-49158 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49158

Vulnerability Analysis

The Trend Micro Apex One security agent loads one or more dependencies using an uncontrolled search path. Windows resolves unqualified module or executable names by walking a defined search order, and any writable directory that appears earlier in that order becomes an injection point. When the agent runs with elevated privileges, a malicious binary placed in an attacker-controlled location executes in the agent's security context.

The issue falls under CWE-427: Uncontrolled Search Path Element. Local privilege escalation is the direct consequence because the Apex One agent runs as a privileged Windows service. The attack does not require user interaction once the low-privileged foothold exists.

Root Cause

The root cause is the agent's use of relative paths or unqualified module names during process or library loading. Without an absolute path or safe search flags such as LOAD_LIBRARY_SEARCH_SYSTEM32, Windows searches the current working directory, user-writable application directories, or PATH entries before trusted system locations. An attacker who can plant a file in one of those locations wins the load race.

Attack Vector

An attacker first obtains low-privileged code execution on the endpoint through phishing, a malicious document, or another initial-access technique. The attacker then stages a malicious DLL or executable in a directory that the Apex One agent searches before the legitimate binary location. When the vulnerable code path triggers, the agent loads the attacker's payload with elevated privileges.

Because exploitation depends on the local search order, defenders should treat any unexpected write to Apex One installation paths or adjacent directories as suspicious. See the ZDI-25-365 advisory for additional context on the affected component.

Detection Methods for CVE-2025-49158

Indicators of Compromise

Unexpected DLL or executable files written into Trend Micro Apex One installation directories or subdirectories
New binaries appearing in directories referenced by the PATH variable of Apex One service accounts
Apex One agent processes loading modules from non-standard paths outside C:\Program Files or C:\Windows\System32
Child processes spawned by Apex One agent binaries that do not match the vendor's known process tree

Detection Strategies

Monitor Sysmon Event ID 7 (Image Loaded) for Apex One agent processes loading unsigned or unexpected modules
Alert on file creation events in Apex One directories from non-installer, non-update processes
Baseline the module load paths of Apex One agent binaries and flag deviations
Correlate low-privileged process activity with subsequent SYSTEM-context executions originating from Apex One

Monitoring Recommendations

Enable module load logging via Sysmon or endpoint telemetry across all endpoints running Apex One
Track integrity of files in Apex One directories using file integrity monitoring
Review scheduled tasks and services that reference Apex One binaries for path hijacking opportunities
Audit PATH environment variables on endpoints for user-writable entries that precede system directories

How to Mitigate CVE-2025-49158

Immediate Actions Required

Apply the Trend Micro fixes documented in Solution Article KA-0019917 to all Apex One agents
Inventory endpoints running Apex One on-premises and SaaS agents and confirm patch status
Restrict write permissions on Apex One installation directories to administrators and SYSTEM only
Remove any user-writable directories from system-wide PATH entries

Patch Information

Trend Micro has released updates for both on-premises and SaaS deployments of Apex One. Administrators should follow the remediation steps in Trend Micro Solution Article KA-0019917. SaaS customers receive updates through Trend Micro's managed update channel, while on-premises administrators must deploy the patched agent build through the management console.

Workarounds

Enforce least privilege on endpoints to reduce the pool of users who can stage malicious binaries
Apply application control policies that block execution of unsigned binaries from user-writable directories
Audit and remove writable directories that appear early in service account search paths
Monitor for anomalous module loads by Apex One agent processes until patches are deployed

bash

# Windows command to audit PATH for user-writable directories
for %P in ("%PATH:;=" "%") do @icacls %P 2>nul | findstr /I "Users Everyone Authenticated"