CVE-2025-31286 is a Medium severity (CVSS 4.6) HTML injection flaw in Trend Vision One. Trend's bulletin says the issue was fixed in the backend service and is no longer an active vulnerability. The vendor lists it as informational, with no customer action required.
What's affected
The record says an HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. It then adds that the issue has already been addressed in the backend service and is no longer considered an active vulnerability.
Trend's support article carries the title that says it is an informational bulletin with no customer action required, covering Broken Access Control and HTML Injection in its Vision One product. It states that the issues are historical and published to acknowledge researchers.
The weaknesses attached in the record are CWE-269 (improper privilege management) and CWE-79 (cross site scripting). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N. The record does not mark the CVE as in CISA KEV.
Because Vision One is a hosted service, there are no customer side versions to track. That is the point of the notice: the vendor fixed it where it runs.
How to check if you're exposed
There is nothing to scan for on your side. The vendor states no action is required and the fix was applied to the service. Still, a few quick checks are worth doing so this is closed in your own records.
First, confirm that your organization uses Trend Vision One and that the platform is the hosted service, not a self managed component. The bulletin concerns the hosted service.
Second, open the vendor's article and read the listed issues. If your security team tracks third party advisories, record the CVE, the date, and the vendor's statement that it is resolved.
Third, if you manage a vendor risk file, note that the vendor disclosed the issue after the fix. A disclosure after remediation is the normal way hosted vendors handle this, and it is useful to keep for audits.
What to do now
- Read the vendor bulletin and record that no customer action is required.
- Mark the CVE as resolved by the vendor in your vulnerability tracker, with the bulletin as the reference.
- If you have a vendor risk register, add a note with the date and the vendor's statement.
- Review who in your organization can post content that others see in the console, such as notes and names, as part of normal hygiene.
- Keep your account's multi factor authentication and role assignments reviewed, since those are within your control.
Why it matters
This one is a useful example of how software as a service vulnerabilities differ. In a product you install, a CVE means you must patch. In a hosted service, the vendor patches for everyone at once, and the CVE exists mostly so customers and researchers have a record of what happened.
The weakness is HTML injection, where content supplied by a user is rendered by a page without being cleaned. It belongs to the family of CWE-79 issues. The rating is Medium because the flaw needed some privileges and user involvement, per the vector. For readers, the lesson is how to read such bulletins: look for whether the fix is in the service, whether action is needed, and whether the vendor says exploitation took place. Here the vendor says none is needed.
It is still worth tracking, because a clear record of what your vendors told you is exactly what an auditor asks for.
Quick check
Do I need to update anything?
No. Trend's bulletin is informational and says no customer action is required, because the fix was applied to the backend service.
Why does a fixed issue still get a CVE?
CVEs for hosted services record the issue and credit the researcher, even when customers have nothing to install.
Sources
Last reviewed: 19 October 2026.
