TrendAI Vision One Service Gateway Logs Information Disclosure Vulnerability

July 29th, 2026
ZDI-26-497 ZDI-CAN-28148

CVE ID

CVE-2025-71386

CVSS Score

7.7 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected Vendors

Trend Micro

Affected Products

Vision One

Vulnerability Details

This vulnerability allows remote attackers to disclose sensitive information on affected installations of TrendAI Vision One. Authentication is required to exploit this vulnerability.

The specific flaw exists within the Service Gateway module. The issue results from storing sensitive information in a log file. An attacker can leverage this vulnerability to disclose sensitive information, leading to further compromise.

Additional Details

Trend Micro has issued an update to correct this vulnerability. More details can be found at:
https://success.trendmicro.com/en-US/solution/KA-0023937

Disclosure Timeline

  • 2025-09-17 - Vulnerability reported to vendor
  • 2026-07-29 - Coordinated public release of advisory
  • 2026-07-29 - Advisory Updated

Credit

Hugo LECLERCQ

Back to Advisories