What is the CVSS score of CVE-2025-47865?

CVE-2025-47865 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Trend Micro are affected by CVE-2025-47865?

Trend Micro Apex Central versions below 8.0.6955 contain a local file inclusion vulnerability that allows authenticated low-privilege users to execute arbitrary code on the system.. A patch is available.

How to fix or mitigate CVE-2025-47865?

Within 24 hours: identify all Trend Micro Apex Central installations and current versions via inventory systems. Within 7 days: upgrade all instances to version 8.0.6955 or later per Trend Micro vendor advisory; validate upgrades in a test environment first. Within 30 days: audit access logs for Apex Central to identify any unauthorized file access or code execution attempts by low-privilege accounts.

Trend Micro CVE-2025-47865

EUVD-2025-18519 HIGH

Undefined Behavior for Input to API (CWE-475)

2025-06-17 security@trendmicro.com

RCE Trend Micro LFI Apex Central

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:38 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0.6955

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18519

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 18:15 nvd

HIGH 7.5

DescriptionCVE.org

A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.

AnalysisAI

Local File Inclusion (LFI) vulnerability in Trend Micro Apex Central widgets that enables remote code execution (RCE) on affected systems. This vulnerability affects Trend Micro Apex Central installations below version 8.0.6955 and requires an authenticated attacker with low privileges to exploit. The vulnerability combines LFI with RCE capabilities, representing a significant threat to organizations using vulnerable Apex Central deployments.

Technical ContextAI

This vulnerability exploits improper input validation in Trend Micro Apex Central's widget handling mechanism, classified under CWE-475 (Undefined Behavior). The root cause involves inadequate sanitization of file path parameters within widget processing logic, allowing attackers to traverse the file system and include arbitrary local files. This LFI can be chained with file upload or code execution mechanisms to achieve remote code execution. The vulnerability affects the widget component architecture of Apex Central, which handles administrative functions and security policy management across enterprise endpoints.

RemediationAI

Immediate remediation: Upgrade Trend Micro Apex Central to version 8.0.6955 or later. Organizations unable to patch immediately should: (1) Restrict network access to Apex Central administrative interfaces using firewall rules and VPN requirements; (2) Enforce strong authentication mechanisms and multi-factor authentication for all Apex Central administrative accounts; (3) Monitor widget processing logs for suspicious file path traversal patterns; (4) Implement file integrity monitoring on Apex Central installation directories; (5) Review access logs for accounts showing unusual widget activity or file inclusion attempts. Consult Trend Micro security advisory for detailed patch deployment procedures and version verification steps.