DaystoPatch

Trend MicroExploited incident

Trend Micro Apex One (on-prem) management console command injection exploited before patch

CVE-2025-54948, CVE-2025-54987Critical, CVSS 9.4In CISA's Known Exploited Vulnerabilities catalog since 18 Aug 2025

  • Exploited before a fix
FixedFixed for every supported version 10 days after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
10d
First public report to first fix
Follow-through
10d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Trend Micro CSAF advisory 2025-0805-TM-A1-002CuratedQuote verified

    "initial_release_date": "2025-08-05T10:00:00.000Z"

    Exploitation was found by Trend Micro's own incident response team (credited for CVE-2025-54948); the bulletin was the first public signal.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6c184ad84261a463…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    Trend Micro advisory 2025-0805-TM-A1-002ClaimedQuote verified5 Aug 2025, 10:00 UTC

    ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One (On-Premise) Management Console Command Injection RCE Vulnerabilities

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6c184ad84261a463…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-54948ClaimedQuote verified5 Aug 2025, 13:00 UTC

    A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7e82e241adaa82e8…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet5 Aug 2025, 13:32 UTC

    You can now share your thoughts on vulnerability CVE-2025-54948 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet6 Aug 2025, 14:04 UTC

    CVE Alert: CVE-2025-54948 - https://www. redpacketsecurity.com/cve_aler t_cve-2025-54948/ # OSINT # ThreatIntel # CyberSecurity # cve_2025_54948

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-54948)ClaimedQuote verified18 Aug 2025

    Trend Micro Apex One OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2025-08-18.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Trend Micro advisory 2025-0805-TM-A1-002ClaimedQuote verified

    ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One (On-Premise) Management Console Command Injection RCE Vulnerabilities

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6c184ad84261a463…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Trend Micro CSAF advisory 2025-0805-TM-A1-002CuratedQuote verified5 Aug 2025, 10:00 UTC

    "initial_release_date": "2025-08-05T10:00:00.000Z"

    The HTML bulletin shows 'Release Date: August 5, 2025' and an ITW notification.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6c184ad84261a463…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date onlysame day

    Trend Micro ITW critical security bulletin KA-0020652CuratedQuote verified

    Please note that the original version of the tool released on August 5th was reported to fail in some non-standard customer configurations, so an updated version was uploaded on Aug. 6, 2025.

    FixTool_Aug2025 is described as a 'Short Term Mitigation' that disables the Remote Install Agent function.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d879eceb21659b90…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    +10d

    Trend Micro CSAF advisory 2025-0805-TM-A1-002CuratedQuote verified

    "date": "2025-08-15T19:00:00.000Z"

    CSAF revision 2, summary 'Updated solution' (the time the advisory was updated, not necessarily the patch upload time).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6c184ad84261a463…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    Trend Micro advisory 2025-0805-TM-A1-002ClaimedQuote not found in archive31 Jul 2025, 19:00 UTC

    Backend Mitigation Applied

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:d879eceb21659b90…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Trend Micro advisory 2025-0805-TM-A1-002ClaimedQuote verified5 Aug 2025, 19:00 UTC

    FixTool_Aug2025

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d879eceb21659b90…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Trend Micro ITW critical security bulletin KA-0020652CuratedQuote verified15 Aug 2025

    A permanent Critical Patch for the Trend Micro Apex One Managment Console (on-prem) was released on August 15, 2025.

    SP1 CP B14081. ('Managment' is the page's own spelling.)

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d879eceb21659b90…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Trend Micro advisory 2025-0805-TM-A1-002ClaimedQuote verified15 Aug 2025, 19:00 UTC

    SP1 CP B14081

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d879eceb21659b90…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date only+10d

    Trend Micro ITW critical security bulletin KA-0020652CuratedQuote verified

    A permanent Critical Patch for the Trend Micro Apex One Managment Console (on-prem) was released on August 15, 2025.

    Apex One 2019 on-prem is the only affected product line.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d879eceb21659b90…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Trend Micro Apex One console flaw exploited; mitigation Aug 5, patch Aug 15 2025

Attackers tried to exploit a command-injection flaw in the on-premise Trend Micro Apex One management console that lets them run code without logging in; Trend Micro issued a mitigation tool on August 5, 2025 and a permanent patch on August 15, 2025.

In plain words

Trend Micro Apex One, an endpoint security product, had a serious flaw in its on-premise management console that could let an attacker take over the server without a password, and Trend Micro saw attackers try to use it. A temporary fix was available on August 5, 2025 and the permanent patch on August 15, 2025. If we run Apex One on our own servers, we need to confirm the August 15, 2025 patch (or later) is installed and that the console is not exposed to the internet.

What happened and who is affected

What happened

On August 5, 2025 Trend Micro disclosed two command-injection flaws in the on-premise Apex One management console (CVE-2025-54948 and CVE-2025-54987, CVSS 9.4) and said it had seen at least one attempt to exploit one of them in the wild. It released a short-term fix tool the same day and a permanent Critical Patch (SP1 CP B14081) on August 15, 2025. The cloud versions were already protected by a back-end change on July 31, 2025.

Who is affected

Organizations running Trend Micro Apex One 2019 on-premise with Management Server version 14039 or below. Apex One as a Service and Trend Vision One Endpoint Security - Standard Endpoint Protection were mitigated by Trend Micro on July 31, 2025.

CVE-2025-54948, CVE-2025-54987. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/trend-micro-cve-2025-54948/

Affected products

  • Trend Micro Apex One 2019 (on-premise) Management Server version 14039 and below
How we built this timeline

Grouping: CVE-2025-54948 and CVE-2025-54987 are in the same bulletin (54987 is 'essentially the same as CVE-2025-54948 but targets a different CPU architecture'); only 54948 is in KEV and it leads the bulletin, so it is the primary. exploited before a fix=true: the bulletin carries an ITW notification at first release (before the 15 Aug 2025 patch), and Trend Micro's IR team is credited with finding CVE-2025-54948. SaaS (Apex One as a Service, Vision One SEP) back-end was mitigated by Trend Micro on 31 Jul 2025, before disclosure; it is not recorded as a moment because the bulletin lists SaaS as not affected ('N/A*') and the fix was vendor-side.

CVSS 9.4 from Trend Micro. ZDI advisories ZDI-25-771/772 correspond.

Related

No related incidents.

Trend Micro report card