Emergency mitigations are recommended following CVSS 9.4-level vulnerabilities exposing affected management console modules to severe RCE attacks.
Two critical security flaws, CVE-2025-54948 and CVE-2025-54987, both carrying a CVSS score of 9.4, have been publicly disclosed affecting the on-premises Apex One Management Console from Trend Micro.
These vulnerabilities, uncovered by security researcher Jacky Hsieh of CoreCloud Tech, are classified as command injection and remote code execution (RCE) flaws that can be exploited by pre-authenticated remote attackers.
Both flaws, which essentially stem from the same underlying issue but target different CPU architectures, allow attackers to upload malicious code and execute commands with elevated privileges on vulnerable installations.
Trend Micro confirmed it had observed at least one attempt to exploit the vulnerabilities in the wild, raising concerns about increased risk for organizations running unpatched systems. Notably:
- The management console is typically accessed via TCP ports 8080 or 4343: the vulnerability arises from improper input validation, permitting attackers to execute system calls with the privileges of the web server account.
- The affected products are Apex One (on-premises version) Management Server Version 14039 and below, as well as Apex One 2019 for the Windows platforms.
- The cloud version of this software, in contrast, had received automatic backend mitigations deployed on 31 July 2025.
- Although a formal patch is not expected until mid-August 2025, Trend Micro has released an emergency mitigation tool to protect on-premises customers in the interim.
- Organizations applying this tool should be aware it disables the Remote Install Agent feature, forcing administrators to use alternative agent deployment methods for now.
Security experts strongly urge enterprises to apply the mitigation tool, restrict network access to the console, and avoid exposing its IP address to the public internet. A permanent patch will restore full console functionality when released later in August.
The discovery, marked by responsible disclosure, underscores how rapidly zero-day flaws are now being weaponized. As attempts to exploit the vulnerabilities have already been detected, experts advise urgent action to minimize enterprise exposure.
