CVE-2025-53378 is a high severity (CVSS 7.6) missing authentication flaw in the Trend Micro Worry-Free Business Security Services agent. It could have let an unauthenticated attacker take control of the agent. It affected the SaaS client only, and Trend Micro fixed it in a monthly maintenance update, so check that agents are current.
What's affected
Trend Micro security bulletin KA-0019936 lists the issue as a missing authentication vulnerability, ZDI-CAN-25342, with a CVSS v3.1 score of 7.6. It says the flaw is CWE-306, missing authentication for a critical function.
The bulletin says the vulnerability only affected the SaaS client version of Worry-Free Business Security Services (WFBSS), not the on premises Worry-Free Business Security. It says the issue was addressed in a WFBSS monthly maintenance update, so no other customer action is required if agents are on the regular SaaS maintenance schedule. The bulletin lists the WFBSS May 2025 Monthly Release (6.7.3954 and 14.3.1299) for Windows as the solution for the group of issues it covers.
The same bulletin covers other CVEs for the on premises product, with a patch named WFBS 10 SP1 Patch 2514. Those are separate records.
How to check if you're exposed
For SaaS managed agents the vendor schedule does the work, so check that the agents are actually receiving updates. In the WFBSS web console, open the device list and look at the agent version and the last update time. Machines that have been offline for a long time, or that block the update servers, may be behind.
For anything on premises, read the bulletin to confirm that your product is not in scope for this particular CVE, and check its separate patches.
On a Windows device you can review installed security software from an elevated prompt:
wmic product where "name like '%Worry%'" get name,version
Compare the agent version with the one the console shows as current.
What to do now
- Open the WFBSS console and check that every agent has updated since the May 2025 monthly release.
- Investigate devices that are offline or blocked from update servers, and bring them current.
- Read Trend Micro bulletin KA-0019936 in full, including the separate on premises fixes.
- Review your policy for remote access to critical systems and keep perimeter controls current, as the bulletin recommends.
- Keep a record of the agent versions you verified for your audit trail.
Why it matters
Missing authentication means a function that should check who is calling does not check at all. In a security agent that matters, because the agent runs with high privileges on the endpoint and may accept instructions from the network. The bulletin says an attacker could remotely take control of the agent.
The vector in the record includes user interaction, and the bulletin lists mitigating factors: exploits of this kind generally need an attacker to have access to a vulnerable machine, and customers should keep patches current and review remote access. The CVE is not on the CISA Known Exploited Vulnerabilities list. Because the vendor handled the fix centrally for SaaS clients, the remaining task for you is verification.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if I use the SaaS version?
The bulletin says no other action is needed if agents are on the regular SaaS maintenance schedule. Verify that the agents did update.
Is the on premises product affected?
The bulletin says this CVE only affected the SaaS client. Other CVEs in the bulletin cover on premises fixes.
Sources
Last reviewed: 18 October 2026.
