Trend Micro has released mitigations for critical vulnerabilities, CVE-2025-54948 and CVE-2025-54987, in their Apex One Management Console, rated 9.4 on the CVSS. These vulnerabilities involve command injection and remote code execution, allowing attackers to upload malicious code. Although both flaws are similar, they affect different CPU architectures. Trend Micro has observed active exploitation attempts. Mitigations for on-premise versions are available via a fix tool, with a formal patch expected in mid-August 2025. The tool protects against known exploits but disables the Remote Install Agent function for administrators.
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
Trend Micro pointed out that while the tool fully protects against known exploits, it will disable the ability for administrators to utilize the Remote Install Agent function to deploy agents from the Trend Micro Apex One Management Console.
Collection
[
|
...
]