CVE-2025-54948

What it actually does

The flaw is a pre-authentication remote code execution vulnerability in the Trend Micro Apex One on-premise management console. An attacker who can reach the console over the network can upload malicious code before authentication and cause the server to execute operating-system commands. Successful exploitation gives the attacker code execution in the context of the Apex One management service or associated web service account, which can enable web shell deployment, credential access, modification of security policies, disabling of endpoint protections, and lateral movement from a highly trusted security-management server.

Why it matters to the business

This is a critical, actively exploited vulnerability in a security management platform. Because Apex One servers commonly manage endpoint protection across many workstations and servers, compromise can undermine defensive controls at scale, interrupt security operations, expose sensitive endpoint and policy data, and provide a foothold for broader enterprise intrusion. The vulnerability is listed in CISA KEV with a remediation deadline of 2025-09-08, which has passed, so any remaining exposure should be treated as urgent even though ransomware use is not currently indicated in the provided data. The EPSS score indicates meaningful internet-scale exploitation likelihood, and active in-the-wild exploitation raises the priority above routine patching.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable Apex One on-premise management console. Because the vulnerability is pre-authentication, the attacker does not need valid console credentials. They send a crafted request that abuses the vulnerable upload/command-execution path to place malicious code on the server or trigger command execution directly. Once code execution is achieved, the attacker typically validates execution with simple commands, deploys a web shell or remote access tooling, enumerates the host and domain context, attempts to extract service credentials or administrative material, and may use the Apex One server’s trusted management role to disable protections, alter policies, stage additional payloads, or pivot to managed endpoints and adjacent systems. In observed active-exploitation scenarios, defenders should assume the initial RCE may have been followed quickly by persistence and hands-on-keyboard activity.

How to fix it

Apply the vendor-provided Trend Micro Apex One on-premise security update or hotfix that addresses this vulnerability as soon as possible. If an exact fixed build is not available in local asset records, update Apex One to the latest vendor-supported build and confirm the vendor advisory for this CVE is marked remediated. Restrict management-console access to trusted administrative networks or VPN-only access, block public internet exposure, and enforce firewall rules so only authorized administrators can reach the console. If immediate patching is not possible, isolate the management console, disable unnecessary external access, monitor aggressively for exploit attempts, and consider taking the console offline until remediated. After patching, rotate credentials that may have been accessible to the Apex One server, review endpoint-protection policies for unauthorized changes, and rebuild the server from known-good media if evidence of compromise is found.

How to confirm the fix worked

Confirm the installed Apex One on-premise build includes the vendor fix for this vulnerability and that the management console is no longer reachable from untrusted networks. Validate externally and internally that only approved administrative source ranges can access the console ports. Review vendor update status, hotfix inventory, file integrity, and service restart timestamps. Run a controlled vulnerability scan or vendor-recommended verification procedure to confirm the vulnerable condition is no longer reported. Validate that no unexpected executable, script, archive, or web-accessible files exist under Apex One server web and application directories. Check that endpoint policies, administrator accounts, and server settings have not been modified without authorization.

Typical attack path

1. Scan for reachable Trend Micro Apex One on-premise management consoles.
2. Send a crafted unauthenticated request to the vulnerable management-console component.
3. Upload malicious server-side code or trigger operating-system command execution.
4. Confirm execution using basic commands such as user, hostname, network, or directory enumeration.
5. Deploy a web shell, downloader, or remote access payload for repeat access.
6. Enumerate local files, Apex One configuration, credentials, service accounts, and network reachability.
7. Disable or weaken endpoint protection policies, tamper with logs, or stage additional payloads.
8. Move laterally from the Apex One server to managed endpoints or other internal systems.

How to detect it

To determine whether exploitation already occurred, review Apex One management-console web access logs, application logs, Windows Security logs, PowerShell logs, Sysmon or EDR telemetry, IIS or bundled web-server logs if present, and file-system artifacts under the Apex One installation and web directories. Look for unauthenticated HTTP POST requests followed by newly created executable or script files, unusual response codes, or access from unfamiliar IP addresses. Hunt for the Apex One management service or web-server process spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, rundll32.exe, or regsvr32.exe. Review Windows Event IDs 4688, 4624, 4672, 7045, 4697, 1102, and PowerShell 4103/4104 for command execution, privileged logons, service creation, log clearing, and encoded or download cradle commands. Inspect web-accessible directories for recently created .jsp, .aspx, .ashx, .php, .exe, .dll, .bat, .cmd, .ps1, .vbs, .js, .zip, .rar, and .7z files. Check for suspicious scheduled tasks, new local administrators, changed Apex One administrator accounts, modified security policies, disabled protection features, new exclusions, or mass agent commands. Because exploitation is reported active in the wild, absence of a known IOC is not sufficient; prioritize behavioral evidence around upload activity, child-process execution, persistence creation, and outbound connections from the Apex One server.

• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• IEX (New-Object Net.WebClient).DownloadString
• Invoke-WebRequest
• Start-BitsTransfer
• certutil.exe -urlcache
• bitsadmin /transfer
• curl.exe http
• wget.exe http
• mshta.exe http
• rundll32.exe javascript:
• regsvr32.exe /s /n /u /i:http
• wscript.exe
• cscript.exe
• C:\Program Files (x86)\Trend Micro\Apex One\PCCSRV\
• C:\Program Files\Trend Micro\Apex One\PCCSRV\
• .aspx
• .ashx
• .jsp
• .php
• .ps1
• .vbs
• .cmd
• .bat
• Event ID 4688
• Event ID 7045
• Event ID 4697
• Event ID 1102
• Event ID 4104

What your security team should do

• Immediately identify all Trend Micro Apex One on-premise management consoles, prioritizing internet-facing or third-party-accessible systems.
• Patch or hotfix all affected Apex One servers; because this is in CISA KEV and the due date has passed, treat unpatched systems as emergency remediation items.
• If patching cannot be completed immediately, restrict console access to trusted administrative networks only and block all public exposure.
• Perform compromise assessment on Apex One servers before and after patching, focusing on web shells, suspicious child processes, unusual uploads, policy tampering, and new administrator accounts.
• Rotate Apex One administrative credentials, service-account credentials, API keys, and any credentials stored or used on the management server if exploitation is suspected.
• Review endpoint-protection policy history for unauthorized exclusions, disabled modules, agent uninstall actions, or suspicious deployment tasks.
• Add SIEM detections for suspicious Apex One server process behavior, especially web or management services spawning command shells, scripting engines, or download utilities.
• Preserve relevant web logs, application logs, Windows event logs, and file-system artifacts before rebuilding or cleaning systems with suspected compromise.
• If evidence of successful exploitation is found, scope laterally to managed endpoints and adjacent infrastructure rather than treating the Apex One server as an isolated incident.