Trend Micro has issued a critical security advisory regarding two remote code execution vulnerabilities, CVE-2025-54948 and CVE-2025-54987, found in its Apex One on-premise management console. Both vulnerabilities carry a maximum CVSS score of 9.4, indicating a severe threat to enterprise networks worldwide. The company confirmed on August 5, 2025, that at least one instance of active exploitation has been observed, prompting urgent action from affected organizations. 'A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations,' the advisory stated.
The vulnerabilities arise from command injection weaknesses that enable attackers to bypass authentication and execute arbitrary commands on systems running unpatched software. Specifically, these vulnerabilities impact the Trend Micro Apex One 2019 Management Server Version 14039 and below. While CVE-2025-54948 and CVE-2025-54987 are fundamentally the same, they differ in their targeting of different CPU architectures, expanding the potential attack surface for malicious actors.
Trend Micro has taken steps to mitigate the risks associated with these vulnerabilities, releasing a temporary tool named 'FixTool_Aug2025' to provide immediate protection. However, the tool disables the Remote Install Agent function for administrators, raising concerns about its usability. A formal patch addressing the vulnerabilities is anticipated to be released by mid-August 2025. The urgency of these vulnerabilities is further emphasized by the Japanese CERT, which has also issued an alert recommending immediate action.
Security experts have highlighted the implications of these vulnerabilities, noting that they could lead to severe breaches in enterprise security infrastructure. 'An unauthenticated attacker with network or physical access to a vulnerable machine can upload arbitrary files, allowing the attacker to execute commands and achieve code execution,' explained a representative from Tenable. The vulnerabilities exploit a lack of proper validation in user-supplied strings before executing system calls, which can allow attackers to execute code in the context of the system user.
As organizations work to secure their systems, Trend Micro emphasizes the importance of immediate updates. 'While it will fully protect against known exploits, we strongly encourage customers to update to the latest builds as soon as possible,' the advisory concluded. Businesses utilizing Apex One are urged to implement the temporary mitigation tool and prepare for the upcoming patch to safeguard their systems against these critical vulnerabilities.
