Apex One command injection flaws exploited

18 August 2025 critical vulnerability

Trend Micro Apex One management console has critical command injection vulnerabilities (CVE-2025-54948, CVE-2025-54987) under active exploitation; patches available.

Japan's IPA has issued an alert for critical remote code execution vulnerabilities in Trend Micro's Apex One, Apex One SaaS, and Standard Endpoint Protection products. The flaws, tracked as CVE-2025-54948 and CVE-2025-54987, are command injection vulnerabilities affecting the management console and are confirmed to be actively exploited in the wild.

Trend Micro has released patches and a mitigation tool (FixTool_Aug2025) for Apex One deployments. Apex One SaaS and Standard Endpoint Protection users do not need to take action as updates are managed by the vendor. Given the active exploitation and the critical nature of these vulnerabilities in widely-deployed enterprise security software, rapid patching is essential.

The IPA updated its advisory on August 19, 2025, to emphasize the urgency following confirmation of real-world attacks. Organizations running affected Trend Micro products should prioritize remediation to prevent compromise of their endpoint security infrastructure.

Mentioned in this report

Vulnerabilities CVE-2025-54948KEVCVE-2025-54987

Detection guidance

Suspicious Child Process Spawned by Trend Micro Apex One Management Console Service

ATT&CK T1210

Detects cmd/powershell or other interpreters spawned by Apex One server/management console processes, consistent with exploitation of CVE-2025-54948/CVE-2025-54987 command injection flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process from Apex One Management Console
id: 0272f6b0-769c-5288-b9bb-188f5cbc197b
status: experimental
description: 'Detects command/script interpreters or shell utilities spawned as children
  of Trend Micro Apex One management console or agent server processes. This pattern
  is consistent with exploitation of the actively-exploited command injection vulnerabilities
  CVE-2025-54948 and CVE-2025-54987, which allow remote code execution via the Apex
  One management console.

  '
references:
- https://www.ipa.go.jp
author: Vorant
tags:
- attack.t1210
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \Apex One\
    - \TrendMicro\
    - \OfficeScan\
    ParentImage|endswith:
    - ofcservice.exe
    - TmListen.exe
    - PccNTMon.exe
    - ntrtscan.exe
    - MasterSvc.exe
    - iisservice.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \net.exe
    - \whoami.exe
    - \certutil.exe
  filter_benign:
    CommandLine|contains:
    - ScanNow
    - /verify_agent
  condition: selection_parent and selection_child and not filter_benign
falsepositives:
- Legitimate Apex One scheduled scan or agent update tasks invoking helper scripts
- Administrative troubleshooting scripts run manually from the console service account
level: high

OS Command Execution via Apex One Web Management Console Process

ATT&CK T1059

Detects command-line execution of system utilities with arguments typical of remote command injection payloads, launched by a web/console service process associated with Apex One infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Command Injection Style Execution from Security Console Service
id: 6d3d2934-9889-5533-924e-8635aff6c678
status: experimental
description: 'Detects execution of shell interpreters with encoded, chained, or download-style
  command-line arguments (e.g. use of ''&&'', ''|'', ''IEX'', base64) launched by
  a process running under a Trend Micro Apex One installation path or service account.
  This behaviour is consistent with post-exploitation command execution following
  successful command injection against the Apex One management console (CVE-2025-54948,
  CVE-2025-54987).

  '
references:
- https://www.ipa.go.jp
author: Vorant
tags:
- attack.t1059
- attack.t1210
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_path:
    ParentImage|contains:
    - \Apex One\
    - \TrendMicro\
  selection_cmd:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
  selection_suspicious_args:
    CommandLine|contains:
    - '&&'
    - '| cmd'
    - IEX(
    - '-enc '
    - -EncodedCommand
    - FromBase64String
  condition: selection_parent_path and selection_cmd and selection_suspicious_args
falsepositives:
- Internal automation or deployment tooling that legitimately invokes PowerShell with
  encoded commands under the same service account
level: high

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20250807.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free