CVE-2025-71210 json
A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands…
published 2026-05-21 5 mo ago modified 2026-07-23 3 mo ago also EUVD-2025-209909
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.8%
- EPSS 3.8% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations.
Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required.
For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.
Patch / fix
- Trend Micro, Inc. TrendAI Apex One 14.0.0.14136
- Trend Micro, Inc. TrendAI Apex One as a Service 14.0.20315
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction
3.81% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Trend Micro, Inc. TrendAI Apex One
- Trend Micro, Inc. TrendAI Apex One as a Service
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
success.trendmicro.com
/en-US/solution/KA-0022458
vendor-advisory
-
zerodayinitiative.com
/advisories/ZDI-26-136/
third-party-advisory
Sources
- CVE List CVE-2025-71210
- NVD CVE-2025-71210
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.