Loading story…
Trend Micro issued security updates for Apex One and related endpoint protection offerings to fix eight vulnerabilities, including two critical path traversal flaws in the Apex One management console tracked as CVE-2025-71210 and CVE-2025-71211. According to the vendor bulletin and CSIRT.SK, the bugs affect Apex One 2019 on-premises for Windows, Apex One SaaS for Windows, Trend Vision One Endpoint – Standard Endpoint Protection SaaS for Windows, and Apex One SaaS for Mac, and could allow an unprivileged attacker with access to the console to upload and execute malicious code.
The same update also addresses six local privilege escalation issues, CVE-2025-71212 through CVE-2025-71217, impacting scanning components and Mac agent services or mechanisms. Organizations were urged to apply Critical Patch Build 14136 for on-premises deployments and Security Agent Build 14.0.20315 for SaaS deployments immediately, while taking additional precautions if management consoles are exposed to the public internet.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published a February 2026 security bulletin for Apex One and Apex One (Mac) describing fixes for eight vulnerabilities, including two critical path traversal flaws and six local privilege escalation issues. The bulletin recommends installing Critical Patch Build 14136 for on-premises deployments and Security Agent Build 14.0.20315 for SaaS deployments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Trend Micro patched two critical remote code execution vulnerabilities in *Apex One* affecting Windows environments**, both caused by **path traversal weaknesses in the Apex One management console**: `CVE-2025-71210` and `CVE-2025-71211`. Trend Micro stated exploitation requires an attacker to have access to the management console, and warned organizations with consoles exposed to the internet to apply mitigations such as source/IP restrictions and to update to the latest builds; the fixes include updates for SaaS deployments and **Critical Patch Build 14136** for affected on-prem installations. Canada’s Centre for Cyber Security issued advisory **AV26-168** urging administrators to apply Trend Micro’s updates for **Apex One (on-premise)**, **Apex One as a Service (SaaS)**, and **Trend Vision One Endpoint / Standard Endpoint Protection (SaaS)**. Neither advisory indicated confirmed exploitation in the wild for these specific CVEs at the time of publication, but the vendor and reporting highlighted that **Apex One vulnerabilities have been actively exploited in prior campaigns**, reinforcing the need for rapid patching and exposure reduction of management interfaces.
Jun 29, 2026
Trend Micro disclosed multiple **critical** vulnerabilities in the **Apex One management console** that could let remote attackers upload malicious code and execute commands on affected systems. The issues include `CVE-2025-54948`, a **CVSS 9.8** directory traversal flaw in the console that can be exploited **without authentication** because of improper validation of a user-supplied path before file operations; successful exploitation can lead to arbitrary code execution in the context of `IUSR`. Public reporting also identified related critical flaws `CVE-2025-71210` and `CVE-2025-71211`, which similarly enable remote code upload and command execution through different executables in the console. Trend Micro said the vulnerabilities were reported through the **Zero Day Initiative** and released updates and guidance for affected customers. The vendor said **SaaS deployments were already mitigated** and require no customer action, but warned that exploitation depends on access to the Apex One Management Console, which listens on **TCP 8080** and **4343** by default in the case of the traversal issue. Organizations with **externally exposed console IPs** were urged to apply patches and restrict source access or otherwise limit exposure until remediation is complete.
Jun 29, 2026
JPCERT/CC warned that multiple vulnerabilities in **TrendAI Apex One**, **Trend Micro Apex One as a Service**, and **TrendAI Vision One Endpoint Security - Standard Endpoint Protection** could let attackers distribute crafted code to security agents or gain elevated privileges. Trend Micro said cloud-side fixes for the hosted products were applied during maintenance in April 2026, but endpoint agents still need to be updated to fully remediate the issue. The most urgent flaw is the on-premises **relative path traversal** vulnerability `CVE-2026-34926`, which Trend Micro confirmed is already being exploited in attacks. JPCERT/CC urged organizations using the on-premises version of TrendAI Apex One to patch immediately, while customers of the cloud-based offerings should also update affected agents to close the remaining exposure.
Jun 29, 2026