TREND MICRO CONFIRMS ACTIVE EXPLOITATION OF CRITICAL APEX ONE FLAWS IN ON-PREMISE SYSTEMS

Summary from the TLDR InfoSec newsletter

Trend Micro confirmed active exploitation of two critical command injection vulnerabilities (CVE-2025-54948 and CVE-2025-54987) in on-premise Apex One Management Console. Rated 9.4 CVSS, the flaws allow pre-authenticated remote attackers to upload malicious code and execute commands on affected installations through insufficient input validation. Mitigations are available via the fix tool, with formal patches expected mid-August 2025, though the fix disables Remote Install Agent functionality.