Critical command injection vulnerabilities in Trend Micro Apex One allow remote code…
Critical command injection vulnerabilities in Trend Micro Apex One allow remote code execution via management console; active exploitation confirmed.
Japan's IPA has issued an alert regarding two critical command injection vulnerabilities (CVE-2025-54948, CVE-2025-54987) affecting Trend Micro Apex One security products. The vulnerabilities exist in the management console and permit remote code execution. IPA confirmed that these vulnerabilities are being actively exploited in the wild, with potential for widespread impact given the deployment of Apex One as an endpoint protection solution.
The alert, updated on August 19, 2025, emphasizes urgent patching for on-premises Apex One installations. Trend Micro has released a mitigation tool called 'FixTool_Aug2025' for Apex One customers. Apex One SaaS and Standard Endpoint Protection users do not require action, suggesting these cloud-managed variants have been addressed by the vendor.
The active exploitation status elevates the risk profile significantly. Organizations running on-premises Apex One deployments should treat this as a critical incident requiring immediate remediation, as compromise of endpoint security infrastructure could provide attackers with privileged access to protected systems across the enterprise.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Trend Micro Apex One Server Process
Detects command/script interpreters spawned by Trend Micro Apex One management/server processes, consistent with exploitation of command injection vulnerabilities (CVE-2025-54948, CVE-2025-54987) in the management console. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from Trend Micro Apex One Server Process
id: c98d4f11-ec0e-5b08-a9fc-8b7bce206d63
status: experimental
description: 'Detects cmd.exe, powershell.exe, cscript.exe, wscript.exe, or other
script interpreters spawned as
children of Trend Micro Apex One server/management processes. This behaviour is
consistent with active
exploitation of the command injection vulnerabilities CVE-2025-54948 and CVE-2025-54987
affecting the
on-premises Apex One management console, which permit remote code execution through
the server process.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \TmListen.exe
- \ofcservice.exe
- \OfcServer.exe
- \PccNTMon.exe
- \CNTAoSMgr.exe
- \iTMSTM.exe
- \TmCCSF.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks invoked by Apex
One service accounts
- Trend Micro update or patch routines that legitimately spawn helper scripts from
server processes
level: high
Web Shell-like Script File Dropped in Trend Micro Apex One Web Console Directory
Detects creation of script/executable files with web-executable extensions within Trend Micro Apex One web management console directories, indicative of a web shell dropped via command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script File Written to Apex One Web Management Console Directory
id: 62d495fc-2624-5d81-b66b-6f4fb5f5d761
status: experimental
description: 'Detects creation of files with script or web-executable extensions (jsp,
jspx, php, aspx, asp, war) within
directories associated with the Trend Micro Apex One web management console. This
pattern is consistent
with an attacker dropping a web shell after exploiting the command injection vulnerabilities
CVE-2025-54948
or CVE-2025-54987 to gain remote code execution against the on-premises management
server.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- \Apex One\
- \OfficeScan\
- \Trend Micro\
selection_ext:
TargetFilename|endswith:
- .jsp
- .jspx
- .php
- .aspx
- .asp
- .war
condition: selection_path and selection_ext
falsepositives:
- Legitimate Apex One console updates or plugin deployments that add new web application
files
- Administrator-initiated customization of the management console web interface
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20250807.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free