Trend Micro Apex One Console Vulnerability Allows Remote Code Execution

The National Vulnerability Database (NVD) reports CVE-2025-71211, a critical vulnerability in the Trend Micro Apex One management console. This flaw, rated 9.8 CVSS, enables a remote attacker to upload malicious code and execute commands on affected installations. It’s a critical remote code execution (RCE) vector, similar in scope to CVE-2025-71210 but impacting a different executable.

Trend Micro has already mitigated this vulnerability for SaaS versions of Apex One, requiring no customer action for those deployments. However, for on-premise installations, the NVD notes that an attacker must first gain access to the management console. Organizations with externally exposed console IP addresses are particularly vulnerable and should implement source IP restrictions immediately if not already in place.

While responsibly disclosed through the Zero Day Initiative, the implications are severe. An unauthenticated attacker gaining RCE on a security product’s management console is a nightmare scenario. This isn’t just about data; it’s about control over your endpoint security posture. This vulnerability, categorized under CWE-22 (Path Traversal), highlights the ongoing challenge of securing management interfaces.