InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included the critical Trend Micro Apex One vulnerability, CVE-2025-54948, in its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation.
Trend Micro Apex One is a popular endpoint security platform that detects and responds to malware and other security threats.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
However, the newly disclosed flaw poses a severe risk to organizations relying on the software for protection.
According to Trend Micro’s advisory, the vulnerability is a remote code execution (RCE) bug caused by a command injection weakness in the Apex One Management Console (on-premise). Alarmingly, the flaw can be exploited without authentication, allowing attackers to execute arbitrary commands remotely.
Trend Micro explains:
“While it will fully protect against known exploits, it will disable the ability for administrators to utilize the Remote Install Agent function to deploy agents from the Trend Micro Apex One Management Console.”
Trend Micro has confirmed at least one exploitation attempt:
“Trend Micro has observed at least one instance of an attempt to actively exploit one of these vulnerabilities in the wild.”
This situation emphasizes the urgent need to apply patches, as attackers are searching for unprotected systems. Organizations with exposed on-premise consoles are at the highest risk.
CISA has directed all Federal Civilian Executive Branch (FCEB) agencies to fix the vulnerability by September 8, 2025. This order promotes prompt action in federal networks and emphasizes the need for private-sector organizations to act quickly as well.
