Loading vulnerability…
CVE-2025-54948 is a critical OS command injection vulnerability in the Trend Micro Apex One on-premise Management Console. The flaw allows a remote attacker to reach the management console without prior authentication and supply crafted input that is insufficiently validated before being passed to system-level execution logic, enabling upload of malicious code and execution of arbitrary operating system commands on the affected server. Reporting also associates the issue with improper validation of user-supplied path data in console file operations, indicating unsafe backend handling of attacker-controlled input. Successful exploitation results in remote code execution on the Apex One server in the security context of the web server account, identified as IUSR in available reporting.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
74 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Apex One remote code execution vulnerability that Trend Micro said was actively exploited.
An Apex One remote code execution vulnerability that Trend Micro reported as actively exploited in 2025.
A remote code execution vulnerability in Trend Micro Apex One that Trend Micro reported as actively exploited in the wild (per the referenced August 2025 warning).
Trend Micro Apex One (on-prem) management console command injection vulnerability reported as exploited in the wild.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.