What is the CVSS score of CVE-2025-71211?

CVE-2025-71211 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Trend Micro Apex One are affected by CVE-2025-71211?

Trend Micro Apex One on-premises management console contains a critical remote code execution vulnerability (CVE-2025-71211, CVSS 9.8) that allows authenticated attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2025-71211?

Within 24 hours: Identify all on-premises Apex One deployments, verify current version, and restrict management console access to trusted internal networks. Within 7 days: Apply patch to upgrade to Trend Micro Apex One 14.0.0.14136 or later on all affected systems. Within 30 days: Implement multi-factor authentication for console access, conduct access review of administrator accounts, and audit console access logs for unauthorized activity.

Trend Micro Apex One CVE-2025-71211

EUVD-2025-209911 CRITICAL

Path Traversal (CWE-22)

2026-05-21 trendmicro

GHSA-qvww-2vwg-9rp6

Trend Micro Path Traversal

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 14:15 vuln.today

Patch available

May 21, 2026 - 14:02 EUVD

DescriptionCVE.org

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable.

Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required.

For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

AnalysisAI

Remote code execution in the Trend Micro Apex One management console allows attackers with console access to upload malicious files via a path traversal flaw (CWE-22) and execute arbitrary commands on the server. The on-premises product (versions before 14.0.0.14136) is affected, while SaaS deployments have already been remediated by the vendor. No public exploit identified at time of analysis; the issue was responsibly disclosed through the Zero Day Initiative (ZDI-26-137).

Technical ContextAI

Trend Micro Apex One is an endpoint protection platform; its on-premises management console is a web-based administrative interface used to centrally configure and deploy security policies to managed endpoints. The underlying weakness is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal), which here permits an attacker to escape the intended upload directory and write attacker-controlled files to executable locations on the host. The vulnerability is sibling to CVE-2025-71210, differing only in the specific console executable handling the upload, indicating a class of input-validation defects in the console's file-handling components. Affected CPEs cover both trendai_apex_one and trendai_apex_one_as_a_service, though the SaaS variant has been patched server-side.

RemediationAI

Vendor-released patch: upgrade on-premises Apex One 2019 (14.0) to build 14.0.0.14136 or later as described in Trend Micro solution KA-0022458 (https://success.trendmicro.com/en-US/solution/KA-0022458); Apex One as a Service has already been updated to 14.0.20315 and requires no customer action. Until the on-premises patch can be applied, restrict the management console's exposure: place the console behind a VPN or jump host, apply source-IP allowlists at the firewall or reverse proxy to limit access to known administrator networks, and remove any direct internet exposure of the console interface. These network restrictions may impact remote administration workflows and any agent-to-server flows that share the same listener, so validate that endpoint check-in still functions after applying ACLs. Additional context is available in the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-137/.