{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-04T07:54:44.530","vulnerabilities":[{"cve":{"id":"CVE-2025-49158","sourceIdentifier":"security@trendmicro.com","published":"2025-06-17T19:15:33.503","lastModified":"2025-09-09T15:24:08.167","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges on affected installations.\r\n\r\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability."},{"lang":"es","value":"Una vulnerabilidad de ruta de búsqueda no controlada en el agente de seguridad de Trend Micro Apex One podría permitir que un atacante local aumente los privilegios en las instalaciones afectadas. Nota: Para explotar esta vulnerabilidad, un atacante debe primero ejecutar código con pocos privilegios en el sistema objetivo."}],"metrics":{"cvssMetricV31":[{"source":"security@trendmicro.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"security@trendmicro.com","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:*","versionEndExcluding":"14.0.14492","matchCriteriaId":"E2378C4C-B4CE-42E6-A506-2AF1B894E421"},{"vulnerable":true,"criteria":"cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:*","versionStartIncluding":"14.0.0.12994","versionEndExcluding":"14.0.0.14002","matchCriteriaId":"2C42CC6D-7812-4564-8002-3E1208E603B8"}]}]}],"references":[{"url":"https://success.trendmicro.com/en-US/solution/KA-0019917","source":"security@trendmicro.com","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-365/","source":"security@trendmicro.com","tags":["Third Party Advisory"]}]}}]}