Trend Micro Patches Critical Apex One RCE Vulnerabilities

Japanese cybersecurity software firm Trend Micro has released urgent security updates for its Apex One endpoint protection platform, addressing two critical vulnerabilities that could allow attackers to execute malicious code on vulnerable Windows systems.

Critical Path Traversal Flaws

The first vulnerability, tracked as CVE-2025-71210, stems from a path traversal weakness in the Trend Micro Apex One management console. This flaw allows unprivileged attackers to execute malicious code on unpatched systems by exploiting improper input validation in the console's file handling mechanisms.

The second critical vulnerability, CVE-2025-71211, is another path traversal issue affecting the Apex One management console. While similar in nature to CVE-2025-71210, this flaw impacts a different executable within the management interface, potentially allowing attackers to bypass security controls and execute arbitrary code.

Exploitation Requirements

According to Trend Micro's security advisory, successful exploitation of these vulnerabilities requires attackers to have access to the Trend Micro Apex One Management Console. The company specifically noted that customers with externally exposed console IP addresses should consider implementing source restrictions and other mitigating factors if not already in place.

"Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to update to the latest builds as soon as possible," the company warned in its advisory.

Patch Availability

To address these critical security flaws, Trend Micro has implemented fixes in the SaaS Apex One versions and released Critical Patch Build 14136. This update not only resolves the two critical path traversal vulnerabilities but also addresses additional security issues:

• Two high-severity privilege escalation flaws in the Windows agent
• Four vulnerabilities affecting the macOS agent

Historical Context of Apex One Exploits

While Trend Micro has not indicated that these specific vulnerabilities are currently being exploited in the wild, the company's endpoint protection platform has been a target for threat actors in recent years. Security researchers have documented multiple instances of Apex One vulnerabilities being weaponized in real-world attacks.

In August 2025, Trend Micro issued an urgent warning to customers about an actively exploited Apex One RCE vulnerability (CVE-2025-54948). The company advised immediate patching to prevent potential compromise of protected systems.

More recently, in September 2022 and September 2023, Trend Micro addressed two zero-day vulnerabilities (CVE-2022-40139 and CVE-2023-41179) that were discovered to be under active exploitation by threat actors.

Broader Security Landscape

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) currently tracks 10 Trend Micro Apex vulnerabilities that have either been or are still being exploited in the wild. This highlights the ongoing security challenges faced by endpoint protection platforms and the importance of timely patching.

Related security incidents in the broader cybersecurity landscape include:

• Trend Micro's warning about a critical Apex Central RCE vulnerability
• The company's fix for an actively exploited remote code execution bug
• A critical Juniper Networks PTX flaw that could allow full router takeover
• CISA's alert about a BeyondTrust RCE flaw now being exploited in ransomware attacks
• Research showing one threat actor responsible for 83% of recent Ivanti RCE attacks

Recommendations for Organizations

Security experts recommend that organizations using Trend Micro Apex One take immediate action to apply the Critical Patch Build 14136. For those with externally accessible management consoles, implementing additional access controls and monitoring for suspicious activity is crucial.

The pattern of repeated vulnerabilities in Apex One underscores the importance of comprehensive security strategies that don't rely solely on a single endpoint protection solution. Organizations should maintain defense-in-depth approaches and regularly audit their security configurations.