Loading vulnerability…
CVE-2025-54948 is a critical remote code execution vulnerability in the Trend Micro Apex One on-premise Management Console. The provided content consistently describes the issue as an OS command injection flaw in the management console backend caused by insufficient validation or sanitization of attacker-controlled input before it is passed to system-level execution logic. Multiple sources in the content state that a remote attacker can upload malicious code and execute arbitrary operating system commands on the affected server. The content also notes related reporting that characterizes the flaw as pre-authentication/unauthenticated and affecting the management console component exposed on TCP ports 8080 and 4343 by default. Successful exploitation results in command execution on the underlying OS, with one cited source stating execution occurs in the context of the IUSR web-server account.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Apex One remote code execution vulnerability that Trend Micro said was actively exploited.
An Apex One remote code execution vulnerability that Trend Micro reported as actively exploited in 2025.
A remote code execution vulnerability in Trend Micro Apex One that Trend Micro reported as actively exploited in the wild (per the referenced August 2025 warning).
Trend Micro Apex One (on-prem) management console command injection vulnerability reported as exploited in the wild.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.