CVE-2025-53378: A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to…

PriorityP265critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.65%

46.4th percentile

A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to remotely take control of the agent on affected installations. Also note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
trend_micro_inc	trend_micro_worry-free_business_security_services	>= SaaS < 6.7.3954 / 14.3.1299	6.7.3954 / 14.3.1299
trendmicro	worry-free_business_security_services	>= 14.0.0 < 14.3.1299	14.3.1299
trendmicro	worry-free_business_security_services	>= 6.7.0.0 < 6.7.3954	6.7.3954

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.