CVE-2025-71210

Published May 21, 2026

Last updated 25 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-71210 is a critical vulnerability identified in the Trend Micro Apex One management console. This flaw is characterized as a path traversal weakness, which could enable remote attackers to upload and execute malicious code on affected systems. Successful exploitation of CVE-2025-71210 necessitates that attackers have access to the Trend Micro Apex One Management Console. Trend Micro has released patches for on-premises users of Apex One to address this and other related vulnerabilities.

Description: A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.
Source: security@trendmicro.com
NVD status: Analyzed
Products: apex_one

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@trendmicro.com: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:*",
            "matchCriteriaId": "739767A5-60D4-47F4-8C64-4D467B577EA1",
            "versionEndExcluding": "14.0.0.14136",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:*",
            "matchCriteriaId": "E2FF211F-6A51-4E98-83A1-AC18122E2473",
            "versionEndExcluding": "14.0.20315",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.