Critical flaws in Trend Micro Apex One Management Console actively exploited
Take action: If you're running on-premise Trend Micro Apex One 2019 (version 14039 or below), immediately download and run the "FixTool_Aug2025" mitigation tool. Your Apex One console is actively exploited. Then reach-out to Trend Micro for a patch and apply it as soon as it's available.
Learn More
Trend Micro released an emergency security bulletin addressing critical command injection vulnerabilities in its Apex One endpoint security platform that are being actively exploited by attackers.
Vulnerabilities summary
- CVE-2025-54948 (CVSS score 9.4) - A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations
- CVE-2025-54987 (CVSS score 9.4) - A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This flaw is essentially represents the same vulnerability as CVE-2025-54948 but targets a different CPU architecture.
These vulnerabilities affect Trend Micro Apex One 2019 Management Server Version 14039 and below.
Until a security patch is available, Trend Micro urged administrators to disable the management console on vulnerable endpoints, even if this means temporarily losing remote management capabilities.
Trend Micro said it "observed at least one instance of an attempt to actively exploit one of these vulnerabilities in the wild." The Japanese CERT also issued an alert regarding the active exploitation of the two flaws, urging users to mitigate the issue as soon as possible
Organizations using Trend Micro Apex One as a Service and Trend Vision One Endpoint Security received automatic protection through backend mitigations deployed on July 31, 2025, without service downtime. On-premise installations remain vulnerable until a patch or mitigation is applied.
Trend Micro has yet to issue security updates to patch this actively exploited vulnerability, but it has released a mitigation tool "FixTool_Aug2025" that provides short-term mitigation against exploitation attempts.
Update - as of 19th of August 2025, CISA confirms active exploitation of CVE-2025-54948. Trend Micro has released a final patch for the flaw. The initially published patch "FixTool_Aug2025" was classified as provisional, as it stalled the remote install function.
