InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included the critical Trend Micro Apex One vulnerability, CVE-2025-54948, in its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation.
Trend Micro Apex One is a popular endpoint security platform that detects and responds to malware and other security threats.
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
However, the newly disclosed flaw poses a severe risk to organizations relying on the software for protection.
According to Trend Micro’s advisory, the vulnerability is a remote code execution (RCE) bug caused by a command injection weakness in the Apex One Management Console (on-premise). Alarmingly, the flaw can be exploited without authentication, allowing attackers to execute arbitrary commands remotely.
Trend Micro explains:
“While it will fully protect against known exploits, it will disable the ability for administrators to utilize the Remote Install Agent function to deploy agents from the Trend Micro Apex One Management Console.”
Trend Micro has confirmed at least one exploitation attempt:
“Trend Micro has observed at least one instance of an attempt to actively exploit one of these vulnerabilities in the wild.”
This situation emphasizes the urgent need to apply patches, as attackers are searching for unprotected systems. Organizations with exposed on-premise consoles are at the highest risk.
CISA has directed all Federal Civilian Executive Branch (FCEB) agencies to fix the vulnerability by September 8, 2025. This order promotes prompt action in federal networks and emphasizes the need for private-sector organizations to act quickly as well.
