Skip to content
Fencer Vulns
critical 9.8

CVE-2025-71211 json

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands…

published 2026-05-21 5 mo ago modified 2026-07-23 3 mo ago also EUVD-2025-209911

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.8%
EPSS 3.8% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable.

Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required.

For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

Patch / fix

  • Trend Micro, Inc. TrendAI Apex One 14.0.0.14136
  • Trend Micro, Inc. TrendAI Apex One as a Service 14.0.20315

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
5 mo ago

Exploit prediction

3.75% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Trend Micro, Inc. TrendAI Apex One
  • Trend Micro, Inc. TrendAI Apex One as a Service

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.