Loading story…
Trend Micro released fixes for three vulnerabilities in Apex Central for Windows, including a critical unauthenticated remote code execution flaw in MsgReceiver.exe, the service that listens on TCP port 20001. Tracked as CVE-2025-69258, the bug lets an attacker send a crafted message that causes the service to load an attacker-controlled DLL via LoadLibraryExA, including from a UNC path, potentially yielding SYSTEM-level code execution. Public reporting indicates the vulnerable logic resides in msgHandlerLogReceiver.dll, and a proof of concept for the critical issue is available.
Two additional high-severity flaws, CVE-2025-69259 and CVE-2025-69260, can be exploited remotely without authentication to crash MsgReceiver.exe and cause denial of service through malformed messages tied to message ID 0x1b5b. One issue stems from missing validation after strstr() can return NULL, while the other involves advancing an internal buffer cursor beyond the end of the buffer, leading to an out-of-bounds read and service failure. The vulnerabilities affect Apex Central versions earlier than Build 7190, and defenders are urged to upgrade immediately or restrict access to trusted IP addresses if patching cannot be completed at once.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Tenable disclosed technical details for the three Apex Central vulnerabilities, including how CVE-2025-69258 can force MsgReceiver.exe to load an attacker-controlled DLL and how the two other flaws can crash the service. The advisory included proof-of-concept Python scripts and analysis of vulnerable logic in msgHandlerLogReceiver.dll.
Trend Micro issued security updates for Apex Central for Windows to remediate three vulnerabilities in MsgReceiver.exe, including critical RCE CVE-2025-69258 and DoS flaws CVE-2025-69259 and CVE-2025-69260. The fixes apply to affected versions earlier than Build 7190, with users advised to upgrade to at least Build 7190.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcetenable.com
Open sourcesuccess.trendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution vulnerability, tracked as CVE-2025-69258, was discovered in Trend Micro Apex Central (on-premise), allowing unauthenticated attackers to load a malicious DLL into the `MsgReceiver.exe` process and execute code with SYSTEM privileges. The flaw, along with two related vulnerabilities (CVE-2025-69259 and CVE-2025-69260), was privately reported by Tenable researchers and affects all previous releases of Apex Central prior to Critical Patch Build 7190. Exploitation requires only network access to the vulnerable system, and technical details as well as proof-of-concept exploits have been publicly released. Trend Micro has issued a critical patch to address these vulnerabilities and strongly urges customers to update to the latest build immediately. The company also recommends reviewing remote access policies and perimeter security to mitigate potential exploitation. The vulnerabilities can be triggered by sending specially crafted messages to the `MsgReceiver.exe` process, which listens on TCP port 20001, with CVE-2025-69258 enabling code execution and the others causing denial of service. No affected product versions were explicitly listed in the CVE database at the time of disclosure, but all prior releases are considered vulnerable.
Jun 29, 2026
Trend Micro released security updates for multiple **critical vulnerabilities** in **Apex Central** and **Endpoint Encryption PolicyServer**, including unauthenticated remote code execution flaws in Apex Central tracked as `CVE-2025-49219` and `CVE-2025-49220`. Both issues stem from insecure deserialization and improper input validation and carry `CVSS 9.8`, allowing attackers to execute code remotely without authentication. Endpoint Encryption PolicyServer is affected by several severe flaws, including `CVE-2025-49216`, which can let an unauthenticated attacker bypass authentication and obtain administrator-level access, and `CVE-2025-49212`, `CVE-2025-49213`, and `CVE-2025-49217`, which can also lead to remote code execution through crafted inputs and deserialization. Additional issues such as `CVE-2025-49218`, `CVE-2025-49215`, and `CVE-2025-49211` may enable SQL injection and privilege escalation, and Trend Micro warned that chaining the bugs could result in full system compromise; administrators were urged to apply **Apex Central patch `CP B7007`** and **Endpoint Encryption PolicyServer Patch 1 Update 6** immediately.
Jul 24, 2026
Trend Micro disclosed multiple **critical** vulnerabilities in the **Apex One management console** that could let remote attackers upload malicious code and execute commands on affected systems. The issues include `CVE-2025-54948`, a **CVSS 9.8** directory traversal flaw in the console that can be exploited **without authentication** because of improper validation of a user-supplied path before file operations; successful exploitation can lead to arbitrary code execution in the context of `IUSR`. Public reporting also identified related critical flaws `CVE-2025-71210` and `CVE-2025-71211`, which similarly enable remote code upload and command execution through different executables in the console. Trend Micro said the vulnerabilities were reported through the **Zero Day Initiative** and released updates and guidance for affected customers. The vendor said **SaaS deployments were already mitigated** and require no customer action, but warned that exploitation depends on access to the Apex One Management Console, which listens on **TCP 8080** and **4343** by default in the case of the traversal issue. Organizations with **externally exposed console IPs** were urged to apply patches and restrict source access or otherwise limit exposure until remediation is complete.
Jun 29, 2026