Trend Micro Apex One EUVD-2025-209909

The attacker requires network reachability to the Apex One management console's web interface - practically meaning either an Internet-exposed console (the case Trend Micro explicitly warns about) or prior access to the internal management network where the console resides. No authentication is required per CVSS PR:N, and no user interaction is required per UI:N. Exploitation is limited to on-premises Apex One 2019 (14.0) below build 14.0.0.14136; SaaS tenants below 14.0.20315 are not exploitable because Trend Micro has already patched the hosted service. Deployments that already restrict console access by source IP, VPN, or management VLAN substantially reduce the exploitable attack surface even before patching.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8 and indicates network-reachable, unauthenticated, no-user-interaction exploitation with full CIA impact - consistent with a path-traversal-to-RCE in a web console. However, the vendor's advisory text qualifies this by noting that an attacker 'must have access to the Trend Micro Apex One Management Console,' which in well-architected deployments is on a management network rather than the public Internet; this materially narrows real-world exposure for customers who do not expose the console externally. SaaS tenants are already mitigated by the vendor, further reducing the affected population. EPSS, KEV, and POC status are not provided in the input - there is no public exploit identified at time of analysis and no CISA KEV listing, but the ZDI advisory implies a researcher possesses working exploit details. Bottom line: high priority for on-premises Apex One 2019 operators, especially any with Internet-exposed consoles, but the practical risk for properly segmented deployments is lower than the 9.8 score suggests.

An attacker who can reach the Apex One management console - for example, because the console's IP is exposed to the Internet or the attacker has gained a foothold on the internal management network - sends a crafted HTTP upload request whose path parameter traverses out of the intended upload directory and writes a web shell into a server-executable location. The attacker then requests the planted file through the console's web server, gaining arbitrary command execution in the context of the Apex One service account and full control of endpoint policy across the managed fleet. No public exploit identified at time of analysis, but the vulnerability was reported through the Zero Day Initiative, meaning a working exploit exists in researcher hands.