Critical severity · published Jul 10, 2025
CVE-2025-53378
A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to remotely take control…
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to remotely take control of the agent on affected installations.
Also note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TM
Trend Micro Worry-Free Business Security Services · Trend Micro, Inc.
SaaS before 6.7.3954 / 14.3.1299 · source: vendor
WB
Worry-free Business Security Services · Trendmicro
6.7.0.0 before 6.7.3954; 14.0.0 before 14.3.1299 · source: NVD
Affected product
TM
Trend Micro Worry-Free Business Security Services
Trend Micro, Inc.
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53378
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53378
Vendor Advisory
https://success.trendmicro.com/en-US/solution/KA-0019936
More from Trend Micro Worry-Free Business Security Services
6.8
CVE-2025-49487
An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine…
