What is the CVSS score of EUVD-2025-209909?

EUVD-2025-209909 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Trend Micro Apex One are affected by EUVD-2025-209909?

Trend Micro Apex One on-premises management console (version 14.0 prior to 14.0.0.14136) contains a critical remote code execution vulnerability allowing attackers with network access to upload…. A patch is available.

How to fix or mitigate EUVD-2025-209909?

24 hours: Identify all Apex One 2019 (14.0) on-premises deployments and document current installed versions. 7 days: Apply vendor-released patch to Apex One 14.0.0.14136 or later for on-premises installations; verify SaaS variant is at version 14.0.20315 or later. 30 days: Audit management console logs for suspicious file upload or path traversal activity; confirm patch deployment across all Apex One on-premises installations.

Trend Micro Apex One EUVD-2025-209909

| CVE-2025-71210 CRITICAL

Path Traversal (CWE-22)

2026-05-21 trendmicro

GHSA-vhc8-fg3x-3rvc

Trend Micro Path Traversal

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 14:15 vuln.today

Patch available

May 21, 2026 - 14:02 EUVD

DescriptionCVE.org

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations.

Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required.

For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

AnalysisAI

Remote code execution in Trend Micro Apex One management console allows attackers with network access to the console to upload malicious files via a path traversal flaw (CWE-22) and execute arbitrary commands on affected installations. The on-premises Apex One 2019 (14.0) prior to 14.0.0.14136 is impacted, while the SaaS variant (below 14.0.20315) has already been mitigated by the vendor; no public exploit identified at time of analysis, though it was reported through the Zero Day Initiative.

Technical ContextAI

The flaw is a path traversal weakness (CWE-22) in the web-based management console of Apex One, Trend Micro's enterprise endpoint protection platform. The CPE entries cpe:2.3:a:trend_micro,_inc.:trendai_apex_one and cpe:2.3:a:trend_micro,_inc.:trendai_apex_one_as_a_service confirm both the on-premises and SaaS deployments contain the affected code path. Path traversal in an upload handler typically arises when user-controlled filename or path parameters are concatenated into a server-side write location without canonicalization, allowing an attacker to place an executable payload (e.g., a web shell or scheduled task) into a directory whose contents are later interpreted by the server.

RemediationAI

Vendor-released patch: upgrade Apex One 2019 (14.0) on-premises to build 14.0.0.14136 or later per Trend Micro advisory KA-0022458 (https://success.trendmicro.com/en-US/solution/KA-0022458); SaaS customers require no action because Trend Micro has already remediated the hosted environment. Until the patch is deployed, restrict network access to the management console by placing it behind a VPN or applying source-IP allowlists at the firewall or reverse proxy so that only administrator workstations and management subnets can reach the console - this has the side effect of blocking remote administration from arbitrary networks and may require updating runbooks for off-network admins. Also review web server logs for unexpected file write paths or new files in console-served directories as a detection compensating control. Cross-reference ZDI-26-136 (https://www.zerodayinitiative.com/advisories/ZDI-26-136/) for additional technical detail.