Trend Micro Apex One command injection enables remote code execution
Critical command injection vulnerabilities in Trend Micro Apex One allow remote code execution via management console; active exploitation confirmed.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-54948 as exploited in the wild.
Japan's IPA has issued an alert regarding two critical command injection vulnerabilities (CVE-2025-54948, CVE-2025-54987) affecting Trend Micro Apex One security products. The vulnerabilities exist in the management console and permit remote code execution. IPA confirmed that these vulnerabilities are being actively exploited in the wild, with potential for widespread impact given the deployment of Apex One as an endpoint protection solution.
The alert, updated on August 19, 2025, emphasizes urgent patching for on-premises Apex One installations. Trend Micro has released a mitigation tool called 'FixTool_Aug2025' for Apex One customers. Apex One SaaS and Standard Endpoint Protection users do not require action, suggesting these cloud-managed variants have been addressed by the vendor.
The active exploitation status elevates the risk profile significantly. Organizations running on-premises Apex One deployments should treat this as a critical incident requiring immediate remediation, as compromise of endpoint security infrastructure could provide attackers with privileged access to protected systems across the enterprise.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Trend Micro Apex One Server Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command/script interpreters spawned by Trend Micro Apex One management/server processes, consistent with exploitation of command injection vulnerabilities (CVE-2025-54948, CVE-2025-54987) in the management console. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from Trend Micro Apex One Server Process
id: c98d4f11-ec0e-5b08-a9fc-8b7bce206d63
status: experimental
description: 'Detects cmd.exe, powershell.exe, cscript.exe, wscript.exe, or other
script interpreters spawned as
children of Trend Micro Apex One server/management processes. This behaviour is
consistent with active
exploitation of the command injection vulnerabilities CVE-2025-54948 and CVE-2025-54987
affecting the
on-premises Apex One management console, which permit remote code execution through
the server process.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \TmListen.exe
- \ofcservice.exe
- \OfcServer.exe
- \PccNTMon.exe
- \CNTAoSMgr.exe
- \iTMSTM.exe
- \TmCCSF.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks invoked by Apex
One service accounts
- Trend Micro update or patch routines that legitimately spawn helper scripts from
server processes
level: high
Web Shell-like Script File Dropped in Trend Micro Apex One Web Console Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of script/executable files with web-executable extensions within Trend Micro Apex One web management console directories, indicative of a web shell dropped via command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Script File Written to Apex One Web Management Console Directory
id: 62d495fc-2624-5d81-b66b-6f4fb5f5d761
status: experimental
description: 'Detects creation of files with script or web-executable extensions (jsp,
jspx, php, aspx, asp, war) within
directories associated with the Trend Micro Apex One web management console. This
pattern is consistent
with an attacker dropping a web shell after exploiting the command injection vulnerabilities
CVE-2025-54948
or CVE-2025-54987 to gain remote code execution against the on-premises management
server.
'
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- \Apex One\
- \OfficeScan\
- \Trend Micro\
selection_ext:
TargetFilename|endswith:
- .jsp
- .jspx
- .php
- .aspx
- .asp
- .war
condition: selection_path and selection_ext
falsepositives:
- Legitimate Apex One console updates or plugin deployments that add new web application
files
- Administrator-initiated customization of the management console web interface
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20250807.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,566 reports from 147 sources, 722 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs