Introduction
Attackers can execute commands remotely on Trend Micro Apex One management consoles without authentication. From there they can upload malicious code and fully compromise the security platform. Enterprises that rely on Trend Micro for endpoint protection are directly affected, which makes this a high-priority risk for security teams.
About Trend Micro Apex One: Trend Micro is a major global cybersecurity vendor with a broad range of security products. Apex One is its flagship endpoint security platform, widely deployed in large enterprises for threat detection, response, and policy enforcement. If attackers compromise the Apex One management infrastructure, they can undermine security across an entire organization.
Technical information
CVE-2025-54987 is an OS command injection vulnerability (CWE-78) in the Trend Micro Apex One (on-premise) management console. It allows a pre-authenticated remote attacker to upload malicious code and execute arbitrary system commands on the affected installation. The flaw is in the console's command processing logic, which does not properly validate or sanitize crafted input and so executes attacker-supplied commands directly.
Key technical details:
- Attack vector: Network (AV:N)
- Attack complexity: Low (AC:L)
- Privileges required: None (PR:N)
- User interaction: None (UI:N)
- Scope: Unchanged (S:U)
- Confidentiality impact: High (C:H)
- Integrity impact: Low (I:L)
- Availability impact: High (A:H)
The vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture. The Zero Day Initiative tracks it as ZDI-CAN-27855. An attacker needs only network access to the management console. No valid credentials or user interaction are required. A crafted payload exploits the insufficient input validation and runs arbitrary commands in the context of the management console.
Affected systems and versions
- Trend Micro Apex One (on-premise) 2019 Management Server Version 14039
- Only the management console component is affected
- The vulnerability targets a specific CPU architecture, different from the one CVE-2025-54948 targets
Vendor security history
In 2025, Trend Micro has had a series of critical vulnerabilities in Apex One, Apex Central, and Endpoint Encryption PolicyServer. Notable recent issues include:
- Five critical vulnerabilities in Apex One disclosed in June 2025 (CVSS 6.7 to 8.8)
- Additional critical flaws in Apex Central and PolicyServer
- Regular collaboration with the Zero Day Initiative and external researchers
- The vendor releases fix tools and advisories quickly, but the pattern of repeated critical flaws suggests underlying problems in secure development and QA
