CVE-2025-54987

CRITICAL EXPLOITED

Trend Micro Apex One - Unauthenticated Remote Code Execution via Malicious Code Upload

Title source: llm

Exploitation Summary

CVE-2025-54987 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture.

References (1)

Core 1

Core References

Patch, Vendor Advisory

https://success.trendmicro.com/en-US/solution/KA-0020652

Scores

CVSS v3 9.4

EPSS 0.0097

EPSS Percentile 76.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

VulnCheck KEV 2025-08-06

CWE

CWE-78

Status published

Products (1)

trendmicro/apex_one 2019

Published Aug 05, 2025

Tracked Since Feb 18, 2026