Loading story…
A critical remote code execution vulnerability, tracked as CVE-2025-69258, was discovered in Trend Micro Apex Central (on-premise), allowing unauthenticated attackers to load a malicious DLL into the MsgReceiver.exe process and execute code with SYSTEM privileges. The flaw, along with two related vulnerabilities (CVE-2025-69259 and CVE-2025-69260), was privately reported by Tenable researchers and affects all previous releases of Apex Central prior to Critical Patch Build 7190. Exploitation requires only network access to the vulnerable system, and technical details as well as proof-of-concept exploits have been publicly released.
Trend Micro has issued a critical patch to address these vulnerabilities and strongly urges customers to update to the latest build immediately. The company also recommends reviewing remote access policies and perimeter security to mitigate potential exploitation. The vulnerabilities can be triggered by sending specially crafted messages to the MsgReceiver.exe process, which listens on TCP port 20001, with CVE-2025-69258 enabling code execution and the others causing denial of service. No affected product versions were explicitly listed in the CVE database at the time of disclosure, but all prior releases are considered vulnerable.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
As of 2026-01-09, reporting from Trend Micro and other coverage indicated there was no confirmed evidence that CVE-2025-69258 had been exploited in the wild. Despite that, public PoC availability increased the risk to internet-facing Apex Central servers.
On 2026-01-08, CVE-2025-69258 was publicly published as a critical Trend Micro Apex Central remote code execution vulnerability with a CVSS score of 9.8. Advisories emphasized that the flaw is network-exploitable without authentication or user interaction and urged customers to apply Trend Micro's updates.
On 2026-01-07, Tenable publicly disclosed the Apex Central vulnerabilities it had privately reported, including technical details and proof-of-concept exploits. The disclosure showed that specially crafted messages to MsgReceiver.exe on TCP port 20001 could let unauthenticated attackers load a malicious DLL and execute code as SYSTEM.
On 2026-01-07, Trend Micro released Build 7190 for on-premises Apex Central to fix three remotely exploitable vulnerabilities affecting earlier versions. The most severe, CVE-2025-69258, allows unauthenticated remote code execution as SYSTEM; CVE-2025-69259 and CVE-2025-69260 can cause denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
arcticwolf.com
Open sourcearcticwolf.com
Open sourcecsoonline.com
Open sourcecvefeed.io
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro released fixes for three vulnerabilities in **Apex Central** for Windows, including a critical unauthenticated remote code execution flaw in `MsgReceiver.exe`, the service that listens on TCP port `20001`. Tracked as **CVE-2025-69258**, the bug lets an attacker send a crafted message that causes the service to load an attacker-controlled DLL via `LoadLibraryExA`, including from a UNC path, potentially yielding **SYSTEM**-level code execution. Public reporting indicates the vulnerable logic resides in `msgHandlerLogReceiver.dll`, and a proof of concept for the critical issue is available. Two additional high-severity flaws, **CVE-2025-69259** and **CVE-2025-69260**, can be exploited remotely without authentication to crash `MsgReceiver.exe` and cause denial of service through malformed messages tied to message ID `0x1b5b`. One issue stems from missing validation after `strstr()` can return `NULL`, while the other involves advancing an internal buffer cursor beyond the end of the buffer, leading to an out-of-bounds read and service failure. The vulnerabilities affect Apex Central versions earlier than **Build 7190**, and defenders are urged to upgrade immediately or restrict access to trusted IP addresses if patching cannot be completed at once.
Jul 24, 2026
Trend Micro released security updates for multiple **critical vulnerabilities** in **Apex Central** and **Endpoint Encryption PolicyServer**, including unauthenticated remote code execution flaws in Apex Central tracked as `CVE-2025-49219` and `CVE-2025-49220`. Both issues stem from insecure deserialization and improper input validation and carry `CVSS 9.8`, allowing attackers to execute code remotely without authentication. Endpoint Encryption PolicyServer is affected by several severe flaws, including `CVE-2025-49216`, which can let an unauthenticated attacker bypass authentication and obtain administrator-level access, and `CVE-2025-49212`, `CVE-2025-49213`, and `CVE-2025-49217`, which can also lead to remote code execution through crafted inputs and deserialization. Additional issues such as `CVE-2025-49218`, `CVE-2025-49215`, and `CVE-2025-49211` may enable SQL injection and privilege escalation, and Trend Micro warned that chaining the bugs could result in full system compromise; administrators were urged to apply **Apex Central patch `CP B7007`** and **Endpoint Encryption PolicyServer Patch 1 Update 6** immediately.
Jul 24, 2026
Trend Micro Apex Central 2019 **Build 6016 and earlier** contains two high-severity authenticated SQL injection vulnerabilities, **`CVE-2023-32529`** and **`CVE-2023-32530`**, that can be escalated to remote code execution. The flaws affect the `modTMMS` certificate-handling workflow, where user-controlled X.509 certificate fields are incorporated into SQLite queries without proper validation, including the `AddCert()` and `DeleteCertById()` paths. Researchers said even low-privilege authenticated users can exploit the bugs by uploading crafted certificate data through `proxy_controller.php`, using `module=modTMMS` and `tmms_cmd=set_certificates_config` to reach the vulnerable functionality. Because Apex Central uses SQLite on the backend, attackers can abuse the injection to write a malicious PHP file into the webroot and execute system commands as the **`IUSR`** account. Both issues carry a **CVSS v3.1 score of 8.8** and were patched by Trend Micro on **December 19, 2022**, before public disclosure by STAR Labs and ZDI. Defenders are advised to update Apex Central to the latest available version and inspect the widget repository directory for suspicious PHP files that could indicate compromise.
Jun 29, 2026