CVE-2025-54948: critical vulnerability in Trend Micro Apex One
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Trend Micro Apex One's management console lets someone upload and run malicious code without needing to log in first. This is serious because attackers can take full control of the security system protecting an organization's computers.
CWE-78 (OS Command Injection) in the Apex One on-premise management console allows pre-authenticated remote code execution via unrestricted file upload functionality. The vulnerability enables arbitrary command execution on the affected system without prior authentication, resulting in complete compromise of the security infrastructure.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.