Critical Command Injection Flaws in Trend Micro Apex One Actively Exploited

Trend Micro has issued an urgent advisory about two critical command injection flaws in Apex One (on-prem) management console for Windows, CVE-2025-54948 and CVE-2025-54987, both carrying a CVSS score of 9.4. According to Trend Micro, at least one of the flaws is being actively exploited in the wild.

The vulnerabilities could allow a pre-authenticated remote attacker to upload and execute arbitrary code on a vulnerable management server, with CVE-2025-54987 targeting a different CPU architecture than CVE-2025-54948. Both flaws fall under CWE-78: OS Command Injection. Trend Micro has released a short-term fix in the form of FixTool_Aug2025 for Apex One (on-prem), which will fully protect against known exploits but will disable the Remote Install Agent function from the Apex One Management Console.

Meanwhile, Apex One as a Service and Trend Vision One Endpoint Security customers have already received back-end mitigations as of July 31, 2025.