CVE-2025-54948: Trend Micro Apex One OS command injection in management console

CVE-2025-54948 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-08-18

Trend Micro Apex One is a centralized security management platform used by organizations to protect endpoints from malware and other threats. A critical vulnerability in its management console allows an unauthorized attacker to remotely upload and run malicious code on the server. This could lead to a complete takeover of the security management system, potentially compromising the entire network of protected devices.

Technologies: Trend Micro Apex One, Trend Micro Apex One as a Service. Vendors: Trend Micro.

Quick answers

Is CVE-2025-54948 exploited in the wild?
Yes. CVE-2025-54948 is known to be exploited in the wild, first recorded on 18 August 2025. Treat it as urgent.
How severe is CVE-2025-54948?
Critical severity, with a CVSS score of 9.8, published 18 August 2025.
Which products and versions are affected?
Trend Micro Apex One (on-premise) management console 2019.
Is there a fix for CVE-2025-54948?
A patch was published on 2025-08-05: Vendor advisory and patch released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54948 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-54948?
Check whether you run Trend Micro Apex One, Trend Micro Apex One as a Service or Trend Micro Worry-Free Business Security. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the Trend Micro Apex One (on-premise) management console. The flaw allows a remote, unauthenticated attacker to bypass security controls to upload malicious files and execute arbitrary commands with elevated privileges on the underlying operating system. The attack vector is network-based and requires no user interaction or prior authentication. This vulnerability has been observed being exploited in the wild. Trend Micro has released a patch to address this issue, and users are advised to apply it immediately.

Affected products

  • Trend Micro Apex One (on-premise) management console 2019

Timeline

  • 2025-08-05: disclosed: Initial disclosure by Trend Micro
  • 2025-08-05: patched: Vendor advisory and patch released
  • 2025-08-18: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2025-08-18: exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.