What is CVE-2022-28394?

CVE-2022-28394 is a high-severity vulnerability in Trend Micro Password Manager, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2022-05-27.

How severe is CVE-2022-28394?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Trend Micro Password Manager

CVE-2022-28394

EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend Micro Incorporated contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427). Please note that this was reported on an EOL version of the product, and users are advised to upgrade to the latest supported version (5.x).

Published 2022-05-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.003 (17.8th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 17.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000

Affected products

Trend Micro Password Manager — versions 3.7.0.1223 and below
Trendmicro Password Manager

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

References

helpcenter.trendmicro.com/ja-jp/article/TMKA-10977 (Vendor Advisory)
jvn.jp/en/jp/JVN60037444/ (Third Party Advisory)
jvn.jp/jp/JVN60037444/ (Third Party Advisory)

Frequently asked questions

What is CVE-2022-28394?: CVE-2022-28394 is a high-severity vulnerability in Trend Micro Password Manager, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2022-05-27.
How severe is CVE-2022-28394?: High severity. CVSS v3 base score is 7.8 out of 10.