Loading story…
Trend Micro patched two critical remote code execution vulnerabilities in Apex One affecting Windows environments, both caused by path traversal weaknesses in the Apex One management console: CVE-2025-71210 and CVE-2025-71211. Trend Micro stated exploitation requires an attacker to have access to the management console, and warned organizations with consoles exposed to the internet to apply mitigations such as source/IP restrictions and to update to the latest builds; the fixes include updates for SaaS deployments and Critical Patch Build 14136 for affected on-prem installations.
Canada’s Centre for Cyber Security issued advisory AV26-168 urging administrators to apply Trend Micro’s updates for Apex One (on-premise), Apex One as a Service (SaaS), and Trend Vision One Endpoint / Standard Endpoint Protection (SaaS). Neither advisory indicated confirmed exploitation in the wild for these specific CVEs at the time of publication, but the vendor and reporting highlighted that Apex One vulnerabilities have been actively exploited in prior campaigns, reinforcing the need for rapid patching and exposure reduction of management interfaces.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On February 25, 2026, the Canadian Centre for Cyber Security published notice AV26-168 highlighting Trend Micro's advisory and urging users and administrators to review the guidance and apply necessary updates. The notice identified affected products including Apex One on-premises, Apex One as a Service, and Trend Vision One Endpoint.
On February 24, 2026, Trend Micro published a security advisory for Apex One and related products covering two critical directory traversal vulnerabilities in the management console that could lead to remote code execution, along with additional high-severity flaws. The advisory said SaaS versions had already been mitigated and released Critical Patch Build 14136 for affected on-premises systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro issued security updates for **Apex One** and related endpoint protection offerings to fix eight vulnerabilities, including two critical path traversal flaws in the Apex One management console tracked as `CVE-2025-71210` and `CVE-2025-71211`. According to the vendor bulletin and CSIRT.SK, the bugs affect **Apex One 2019 on-premises for Windows**, **Apex One SaaS for Windows**, **Trend Vision One Endpoint – Standard Endpoint Protection SaaS for Windows**, and **Apex One SaaS for Mac**, and could allow an unprivileged attacker with access to the console to upload and execute malicious code. The same update also addresses six local privilege escalation issues, `CVE-2025-71212` through `CVE-2025-71217`, impacting scanning components and Mac agent services or mechanisms. Organizations were urged to apply **Critical Patch Build 14136** for on-premises deployments and **Security Agent Build 14.0.20315** for SaaS deployments immediately, while taking additional precautions if management consoles are exposed to the public internet.
Jul 24, 2026
Trend Micro disclosed multiple **critical** vulnerabilities in the **Apex One management console** that could let remote attackers upload malicious code and execute commands on affected systems. The issues include `CVE-2025-54948`, a **CVSS 9.8** directory traversal flaw in the console that can be exploited **without authentication** because of improper validation of a user-supplied path before file operations; successful exploitation can lead to arbitrary code execution in the context of `IUSR`. Public reporting also identified related critical flaws `CVE-2025-71210` and `CVE-2025-71211`, which similarly enable remote code upload and command execution through different executables in the console. Trend Micro said the vulnerabilities were reported through the **Zero Day Initiative** and released updates and guidance for affected customers. The vendor said **SaaS deployments were already mitigated** and require no customer action, but warned that exploitation depends on access to the Apex One Management Console, which listens on **TCP 8080** and **4343** by default in the case of the traversal issue. Organizations with **externally exposed console IPs** were urged to apply patches and restrict source access or otherwise limit exposure until remediation is complete.
Jun 29, 2026
CISA added **`CVE-2026-34926`** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical **Trend Micro Apex One** on-premise flaw. The vulnerability is a directory traversal issue that can be abused by a pre-authenticated local attacker to manipulate file paths, access restricted directories, alter a key database table, and inject malicious code that may then be pushed to connected endpoint agents. Because Apex One centrally manages endpoint protection, a successful compromise could weaken EDR visibility and turn the management server into a distribution point for enterprise-wide malware. Trend Micro issued advisories covering multiple vulnerabilities across **Apex One (on-premise)**, **Apex One as a Service**, and **Trend Vision One Endpoint / Standard Endpoint Protection**, with affected builds including Apex One server and agent versions prior to **2019 build 17079** and SEP agent versions prior to **14.0.20731**. National cyber authorities in Canada, Germany, and Hong Kong circulated related alerts, while CISA directed U.S. federal agencies to remediate the exploited flaw by **June 4, 2026** and urged organizations to apply vendor updates, restrict local access to Apex One servers, and increase monitoring for signs of compromise.
Jun 29, 2026