Trend Micro Apex One EUVD-2025-209911

Exploitation requires network reachability to the on-premises Trend Micro Apex One management console's HTTP(S) interface and the ability to send an upload request to the specific vulnerable console executable (the unnamed sibling of the one in CVE-2025-71210). Per the vendor, only on-premises Apex One 2019 (14.0) builds prior to 14.0.0.14136 are vulnerable - Apex One as a Service (<14.0.20315) has already been patched by Trend Micro and customers cannot exploit or be exploited there. The CVSS vector advertises PR:N (no authentication) and UI:N (no user interaction), but the vendor explicitly notes that the attacker must have access to the management console, so deployments that restrict console access to a management VLAN or VPN are effectively shielded; exposure of the console's IP to the internet is the dominant aggravating factor.

The CVSS:3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated path to full compromise, which on paper is a top-priority bug. However, the vendor advisory and CVE description explicitly state that the attacker must first have access to the Apex One management console - a contradiction with PR:N that materially limits real-world risk for organizations that do not expose the console to the internet. EPSS data was not provided and CISA KEV does not list this CVE, so exploitation probability cannot be quantitatively assessed; it should be treated as not currently known to be exploited in the wild. Net assessment: critical for any deployment with an internet-exposed or broadly reachable management console, materially lower for environments where console access is restricted to administrative networks.

An attacker who can reach the Apex One management console - for example, because the console's IP is exposed to the internet or accessible from a compromised internal host - sends a crafted HTTP upload request to the vulnerable console executable, using directory traversal sequences to drop a malicious file into a directory that the web server or service will execute. The resulting code runs in the context of the management console process, giving the attacker control over policy distribution and, by extension, the ability to push malicious configurations or payloads to managed endpoints. No public exploit identified at time of analysis, though ZDI possesses a private POC from the responsible disclosure.