Trend Micro Apex Central RCE Flaw Scores 9.8 CVSS in On-Prem Windows Versions

Trend Micro has released security updates for Apex Central on Windows to address multiple vulnerabilities, including a critical remote code execution flaw tracked as CVE-2025-69258 with a CVSS of 9.8. According to Trend Micro, the flaw is described as a LoadLibraryEX vulnerability that could allow an unauthenticated remote attacker to load an attacker‑controlled DLL into a key executable, enabling code execution under SYSTEM on affected installations.

The company also patched CVE-2025-69259 and CVE-2025-69260, both rated at CVSS 7.5, which could allow remote, unauthenticated attackers to cause denial-of-service conditions via a message unchecked NULL return value or a message out-of-bounds read, respectively.

Tenable, which is credited with identifying all three flaws in August 2025, said an attacker can exploit CVE-2025-69258 by sending a message “0x0a8d” (SC_INSTALL_HANDLER_REQUEST) to the MsgReceiver.exe component, causing a DLL to be loaded with elevated code execution.

The issues affect Apex Central on-premise versions below Build 7190, and Trend Micro notes exploitation hinges on an attacker already having physical or remote access to a vulnerable endpoint, with guidance to apply patches and review remote access and perimeter security.