CVE-2025-54987CWE-78

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute…

Critical · published August 5, 2025

CVSS v3.1
9.4
EPSS
20%
Percentile
97.4
In the wild
Unconfirmed
What it is

🚨 A pre-authenticated remote attacker can upload malicious code to Trend Micro Apex One's management console, turning your security solution against you! 🔥 Think of it like an unwelcome guest slipping through the front door of a high-security building because no one checked the guest list. This vulnerability allows bad actors to waltz right in and take control of your defenses! The consequences could be absolutely devastating! An attacker could run commands at will, compromising sensitive data and undermining the entire security posture of your organization. Imagine the chaos of losing control over your security management – it's a nightmare scenario!

Put simply

Think of it like an unwelcome guest slipping through the front door of a high-security building because no one checked the guest list. This vulnerability allows bad actors to waltz right in and take control of your defenses! This vulnerability allows a pre-authenticated remote attacker to upload and execute malicious code on Trend Micro Apex One installations, targeting a specific CPU architecture. Essentially, it bypasses the security mechanisms by taking advantage of improper validation processes in the management console.

What to do

The consequences could be absolutely devastating! An attacker could run commands at will, compromising sensitive data and undermining the entire security posture of your organization. Imagine the chaos of losing control over your security management – it's a nightmare scenario! Immediately apply the latest patch from Trend Micro to address this vulnerability. Ensure that your installation is updated to the fixed version and review your security configurations to prevent unauthorized access. Don't forget to audit your logs for any suspicious activity! You've got this! With prompt action, you can secure your installation and keep those unwelcome guests out! 🛡️

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.19692 · 97.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-08-05T13:00Z
EPSS history
Timeline
  • 05 AUG 13:00Z
    A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute…
    cvelistv5