Buffer overflow in Trend Micro Apex Central
Priority MEDIUM 42CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service, Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-120, CWE-346 and the CVSS impact.
Summary
A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01576 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Trend Micro Apex Central (Trend Micro, Inc.): Build 7190
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Trend Micro | Trend Micro Apex Central | 2019 (14.0) to before Build 7190 | Build 7190 | Patch available | CNA |
- Trend Micro Apex Central VendorTrend Micro Affected 2019 (14.0) to before Build 7190 Fixed in Build 7190 Patch available CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:trendmicro:apex_central:2019:-:*:*:-:*:*:* | 2019 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_3752:*:*:-:*:*:* | 2019 build_3752 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_5158:*:*:-:*:*:* | 2019 build_5158 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_6016:*:*:-:*:*:* | 2019 build_6016 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_6288:*:*:-:*:*:* | 2019 build_6288 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_6394:*:*:-:*:*:* | 2019 build_6394 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_6481:*:*:-:*:*:* | 2019 build_6481 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_6511:*:*:-:*:*:* | 2019 build_6511 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_6571:*:*:-:*:*:* | 2019 build_6571 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_6658:*:*:-:*:*:* | 2019 build_6658 | Vulnerable | Trendmicro |
- cpe:2.3:a:trendmicro:apex_central:2019:-:*:*:-:*:*:* Versions 2019 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_3752:*:*:-:*:*:* Versions 2019 build_3752 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_5158:*:*:-:*:*:* Versions 2019 build_5158 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_6016:*:*:-:*:*:* Versions 2019 build_6016 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_6288:*:*:-:*:*:* Versions 2019 build_6288 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_6394:*:*:-:*:*:* Versions 2019 build_6394 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_6481:*:*:-:*:*:* Versions 2019 build_6481 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_6511:*:*:-:*:*:* Versions 2019 build_6511 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_6571:*:*:-:*:*:* Versions 2019 build_6571 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_6658:*:*:-:*:*:* Versions 2019 build_6658 Vulnerable ·Trendmicro
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:trendmicro:apex_central:2019:build_6660:*:*:-:*:*:* | 2019 build_6660 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_6890:*:*:-:*:*:* | 2019 build_6890 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_6955:*:*:-:*:*:* | 2019 build_6955 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_7007:*:*:-:*:*:* | 2019 build_7007 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_7065:*:*:-:*:*:* | 2019 build_7065 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_central:2019:build_7141:*:*:-:*:*:* | 2019 build_7141 | Vulnerable | Trendmicro |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:trendmicro:apex_central:2019:build_6660:*:*:-:*:*:* Versions 2019 build_6660 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_6890:*:*:-:*:*:* Versions 2019 build_6890 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_6955:*:*:-:*:*:* Versions 2019 build_6955 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_7007:*:*:-:*:*:* Versions 2019 build_7007 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_7065:*:*:-:*:*:* Versions 2019 build_7065 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_central:2019:build_7141:*:*:-:*:*:* Versions 2019 build_7141 Vulnerable ·Trendmicro
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Trend Micro Apex Central (Trend Micro, Inc.) Fixed in Build 7190
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Trend Micro Apex Central Build 7190
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2025-42709 Buffer overflow in Trend Micro Apex CentralPriority MEDIUM 55
- TI-2025-42710 Buffer overflow in Trend Micro Apex CentralPriority MEDIUM 42
Timeline
- 2026-10-02 Threatist record created from CVE-2025-69260
- 2026-10-03 Alias added: GHSA-p5v2-mqcc-2j93
References
More Trend Micro vulnerabilities
- TI-2025-34668 OS command injection in Trend Micro Apex One KEVCVSS 3.1CRITICAL 9.8
- TI-2022-10115 Insufficient verification of data authenticity in Trend Micro Apex Central KEVCVSS 3.1CRITICAL 9.8
- TI-2020-06895 Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-14867 Unrestricted file upload in Trend Micro Apex One KEVCVSS 3.1HIGH 8.8
- TI-2020-06795 Injection in Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free… KEVCVSS 3.1HIGH 8.8
- TI-2020-06794 A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a… KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2025-69260 · CVE Program
- CVE-2025-69260 · NVD
- FIRST EPSS
- GHSA-p5v2-mqcc-2j93 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences