CVE-2025-54948: Trend Micro Apex One management console OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityPre-authentication remote code execution in a security management console, listed in CISA KEV with a high EPSS score, makes this an urgent patch.

What it is

The on-premise Apex One management console contains an OS command injection flaw (CWE-78) that lets a remote attacker upload malicious code and run commands on the affected installation. It is pre-authentication and network-reachable, so it exposes the console itself rather than requiring a valid account. Because Apex One is a security management product, compromise of its console undermines the endpoint protection it administers.

Impact

An attacker gains remote code execution on the Apex One server, with high impact to confidentiality, integrity and availability. From there they can control the management console and potentially the endpoints it manages.

Attack surface

Reached over the network against the Apex One management console; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication and no user interaction are required. The description confirms the attacker is pre-authenticated, meaning no valid credentials are needed.

Exploitation

CVE-2025-54948 was added to CISA KEV on 2025-08-18 with a remediation due date of 2025-09-08, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.2204 (97.5th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor patch per Trend Micro advisory KA-0020652 as the first action.
• If patching is not immediately possible, follow CISA BOD 22-01 guidance and the vendor's mitigations, or discontinue use of the product.
• Restrict network access to the Apex One management console so it is not exposed to untrusted networks.
• Monitor for and investigate any signs of compromise on the Apex One server before and after patching.
• Verify the console is not internet-facing and review administrative access controls.

Detection

• Hunt for unexpected child processes spawned by the Apex One management console web service, especially shell or command interpreters.
• Review console and web server logs for anomalous upload requests or command execution patterns around the exploitation window.
• Monitor for new or modified files in console-accessible upload or web directories.
• Alert on outbound connections or process activity from the Apex One server that deviates from its normal baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.