Skip to content
Fencer Intel
critical 9.8

CVE-2025-71210 json

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands…

published 5mo ago modified 3mo ago also EUVD-2025-209909

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.8%
EPSS 3.8% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations.

Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required.

For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

Patch / fix

  • Trend Micro, Inc. TrendAI Apex One 14.0.0.14136
  • Trend Micro, Inc. TrendAI Apex One as a Service 14.0.20315

Is CVE-2025-71210 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
5mo ago

Exploit prediction

3.81% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Trend Micro, Inc. TrendAI Apex One
  • Trend Micro, Inc. TrendAI Apex One as a Service

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.