Loading story…
Trend Micro disclosed multiple critical vulnerabilities in the Apex One management console that could let remote attackers upload malicious code and execute commands on affected systems. The issues include CVE-2025-54948, a CVSS 9.8 directory traversal flaw in the console that can be exploited without authentication because of improper validation of a user-supplied path before file operations; successful exploitation can lead to arbitrary code execution in the context of IUSR. Public reporting also identified related critical flaws CVE-2025-71210 and CVE-2025-71211, which similarly enable remote code upload and command execution through different executables in the console.
Trend Micro said the vulnerabilities were reported through the Zero Day Initiative and released updates and guidance for affected customers. The vendor said SaaS deployments were already mitigated and require no customer action, but warned that exploitation depends on access to the Apex One Management Console, which listens on TCP 8080 and 4343 by default in the case of the traversal issue. Organizations with externally exposed console IPs were urged to apply patches and restrict source access or otherwise limit exposure until remediation is complete.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Trend Micro disclosed two critical Apex One management console vulnerabilities that could let a remote attacker upload malicious code and execute commands on affected installations. The company said the issues were responsibly disclosed through the Zero Day Initiative, SaaS versions had already been mitigated, and customers with exposed console IPs should apply source restrictions if needed.
TrendAI Apex One console vulnerability CVE-2025-54948 was publicly disclosed as a critical unauthenticated remote code execution issue caused by improper path validation before file operations. The vendor issued an update to remediate the flaw.
The directory traversal remote code execution flaw later tracked as CVE-2025-54948 was reported to the vendor on 2025-08-26. The advisory credits Charles Yang of CoreCloud Tech with the discovery.
A critical unauthenticated OS command injection vulnerability in the Trend Micro Apex One on-premise management console, tracked as CVE-2025-54987, was described as allowing remote attackers to upload malicious code and execute arbitrary system commands. The reference says Trend Micro published an advisory and fix tool, and notes the issue is closely related to CVE-2025-54948 but affects a different CPU architecture.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcezerodayinitiative.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro issued security updates for **Apex One** and related endpoint protection offerings to fix eight vulnerabilities, including two critical path traversal flaws in the Apex One management console tracked as `CVE-2025-71210` and `CVE-2025-71211`. According to the vendor bulletin and CSIRT.SK, the bugs affect **Apex One 2019 on-premises for Windows**, **Apex One SaaS for Windows**, **Trend Vision One Endpoint – Standard Endpoint Protection SaaS for Windows**, and **Apex One SaaS for Mac**, and could allow an unprivileged attacker with access to the console to upload and execute malicious code. The same update also addresses six local privilege escalation issues, `CVE-2025-71212` through `CVE-2025-71217`, impacting scanning components and Mac agent services or mechanisms. Organizations were urged to apply **Critical Patch Build 14136** for on-premises deployments and **Security Agent Build 14.0.20315** for SaaS deployments immediately, while taking additional precautions if management consoles are exposed to the public internet.
Jul 24, 2026
**Trend Micro patched two critical remote code execution vulnerabilities in *Apex One* affecting Windows environments**, both caused by **path traversal weaknesses in the Apex One management console**: `CVE-2025-71210` and `CVE-2025-71211`. Trend Micro stated exploitation requires an attacker to have access to the management console, and warned organizations with consoles exposed to the internet to apply mitigations such as source/IP restrictions and to update to the latest builds; the fixes include updates for SaaS deployments and **Critical Patch Build 14136** for affected on-prem installations. Canada’s Centre for Cyber Security issued advisory **AV26-168** urging administrators to apply Trend Micro’s updates for **Apex One (on-premise)**, **Apex One as a Service (SaaS)**, and **Trend Vision One Endpoint / Standard Endpoint Protection (SaaS)**. Neither advisory indicated confirmed exploitation in the wild for these specific CVEs at the time of publication, but the vendor and reporting highlighted that **Apex One vulnerabilities have been actively exploited in prior campaigns**, reinforcing the need for rapid patching and exposure reduction of management interfaces.
Jun 29, 2026
Trend Micro released security updates for multiple **critical vulnerabilities** in **Apex Central** and **Endpoint Encryption PolicyServer**, including unauthenticated remote code execution flaws in Apex Central tracked as `CVE-2025-49219` and `CVE-2025-49220`. Both issues stem from insecure deserialization and improper input validation and carry `CVSS 9.8`, allowing attackers to execute code remotely without authentication. Endpoint Encryption PolicyServer is affected by several severe flaws, including `CVE-2025-49216`, which can let an unauthenticated attacker bypass authentication and obtain administrator-level access, and `CVE-2025-49212`, `CVE-2025-49213`, and `CVE-2025-49217`, which can also lead to remote code execution through crafted inputs and deserialization. Additional issues such as `CVE-2025-49218`, `CVE-2025-49215`, and `CVE-2025-49211` may enable SQL injection and privilege escalation, and Trend Micro warned that chaining the bugs could result in full system compromise; administrators were urged to apply **Apex Central patch `CP B7007`** and **Endpoint Encryption PolicyServer Patch 1 Update 6** immediately.
Jul 24, 2026