Critical severity · published Aug 5, 2025
CVE-2025-54948
Trend Micro Apex One OS Command Injection Vulnerability
In wildKEV
9.8
CVSS
25.4%
EPSS
Yes
On KEV
Description
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)25.4% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Aug 18, 2025
Federal remediation dueSep 8, 2025
Ransomware campaign useNot known
Affected products
Which versions
AO
Apex One · Trend Micro
2019 (14.0) before 14.0.0.14039 · source: vendor, NVD, KEV
In the news
VulnerabilityCritical
ZDI-26-269: TrendAI Apex One Console Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-54948.
Apr 15, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54948
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54948
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
success.trendmicro.com
https://success.trendmicro.com/en-US/solution/KA-0020652
More from Apex One
9.8
CVE-2022-26871
Trend Micro Apex Central Arbitrary File Upload Vulnerability
9.8
CVE-2020-8599
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
8.8
CVE-2021-36741
Trend Micro Multiple Products Improper Input Validation Vulnerability
8.8
CVE-2020-8468
Trend Micro Multiple Products Content Validation Escape Vulnerability
8.8
CVE-2020-8467
Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability