# CVE-2025-54948: Trend Micro Apex One OS command injection in management console

Source: https://junglewise.ai/threats/cve-2025-54948-trend-micro-apex-one-os-command-injection-in-management-console  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-18. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-54948 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-08-18

Trend Micro Apex One is a centralized security management platform used by organizations to protect endpoints from malware and other threats. A critical vulnerability in its management console allows an unauthorized attacker to remotely upload and run malicious code on the server. This could lead to a complete takeover of the security management system, potentially compromising the entire network of protected devices.

Technologies: [Trend Micro Apex One](https://junglewise.ai/threats/technologies/apex-one), [Trend Micro Apex One as a Service](https://junglewise.ai/threats/technologies/apex-one-as-a-service). Vendors: [Trend Micro](https://junglewise.ai/threats/vendors/trend-micro).

## Quick answers

**Is CVE-2025-54948 exploited in the wild?** Yes. CVE-2025-54948 is known to be exploited in the wild, first recorded on 18 August 2025. Treat it as urgent.

**How severe is CVE-2025-54948?** Critical severity, with a CVSS score of 9.8, published 18 August 2025.

**Which products and versions are affected?** Trend Micro Apex One (on-premise) management console 2019.

**Is there a fix for CVE-2025-54948?** A patch was published on 2025-08-05: Vendor advisory and patch released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-54948 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-54948?** Check whether you run Trend Micro Apex One, Trend Micro Apex One as a Service or Trend Micro Worry-Free Business Security. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in the Trend Micro Apex One (on-premise) management console. The flaw allows a remote, unauthenticated attacker to bypass security controls to upload malicious files and execute arbitrary commands with elevated privileges on the underlying operating system. The attack vector is network-based and requires no user interaction or prior authentication. This vulnerability has been observed being exploited in the wild. Trend Micro has released a patch to address this issue, and users are advised to apply it immediately.

## Affected products

- Trend Micro Apex One (on-premise) management console 2019

## Timeline

- 2025-08-05: disclosed: Initial disclosure by Trend Micro
- 2025-08-05: patched: Vendor advisory and patch released
- 2025-08-18: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2025-08-18: exploited: Confirmed active exploitation in the wild

## Related threats

- [Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2023-41179-trend-micro-apex-one-and-worry-free-business-security-remote-code)
- [Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability](https://junglewise.ai/threats/cve-2022-40139-trend-micro-apex-one-and-apex-one-as-a-service-improper)