Type Vulnerability
(on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands… known-exploited catalogue reports exploitation in the wild.
Trend · Code execution
Trend Micro Apex One OS Command Injection Vulnerability
CVE-2025-54948
What this means
This is rated critical severity (9.4 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Trendmicro Apex One is in your estate, and treat that as the priority.
Full vendor description
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
Scoring and exploitation
9.4/ 10
CVSS 3.1 base scoreCritical
Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality and availability; low on integrity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityLowI:L
AvailabilityHighA:H
- Elevated attack likelihood (~32.9% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Trend Micro Apex One
Weaknesses
CWE-78
Affected products ()
- Trendmicro Apex One
Show the raw CPE strings (1)
- cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:on-premises:windows:*:*
References
2 links from the CVE record, grouped by site; the vendor's advisory comes first.
success.trendmicro.com1 linkVendor advisory
- KA-0020652 (opens in a new tab)Patch · Vendor Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource