Critical severity · published Jun 17, 2025
CVE-2025-47867
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and…
9.8
CVSS
1.9%
EPSS
No
On KEV
Description
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apex Central · Trendmicro
2019; 2019; 2019; 2019; 2019; 2019; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-47867
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-47867
Vendor Advisory
https://success.trendmicro.com/en-US/solution/KA-0019355
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-25-297/
More from Apex Central
9.8
CVE-2022-26871
Trend Micro Apex Central Arbitrary File Upload Vulnerability
9.8
CVE-2025-69258
A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to…
9.8
CVE-2025-49220
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations
9.8
CVE-2025-49219
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations
9.8
CVE-2025-47865
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations