Read the docs
TI-2025-43346 Aliases CVE-2025-71211GHSA-qvww-2vwg-9rp6

Path traversal in TrendAI Apex One

Priority MEDIUM 55CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03754 89th percentileScored 2026-11-07
Fix Fixed TrendAI Apex One (Trend Micro, Inc.): 14.0.0.14136TrendAI Apex One as a Service (Trend Micro, Inc.): 14.0.20315

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Trend MicroTrendAI Apex One2019 (14.0) to before 14.0.0.1413614.0.0.14136Patch availableCNA
Trend MicroTrendAI Apex One as a ServiceSaaS to before 14.0.2031514.0.20315Patch availableCNA
  • TrendAI Apex One VendorTrend Micro Affected 2019 (14.0) to before 14.0.0.14136 Fixed in 14.0.0.14136 Patch available CNA
  • TrendAI Apex One as a Service VendorTrend Micro Affected SaaS to before 14.0.20315 Fixed in 14.0.20315 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:*before 14.0.0.14136VulnerableTrendmicro
cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:*before 14.0.20315VulnerableTrendmicro
  • cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:* Versions before 14.0.0.14136 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:* Versions before 14.0.20315 Vulnerable ·Trendmicro

Remediation

  • Fix · CNA TrendAI Apex One (Trend Micro, Inc.) Fixed in 14.0.0.14136
  • Fix · CNA TrendAI Apex One as a Service (Trend Micro, Inc.) Fixed in 14.0.20315

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Trend Micro TrendAI Apex One, TrendAI Apex One as a Service 14.0.0.14136, 14.0.20315

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-43345 Path traversal in TrendAI Apex OnePriority MEDIUM 55
    • TI-2025-43347 Link following in TrendAI Apex OnePriority LOW 37
    • TI-2025-43348 Origin validation error in TrendAI Apex OnePriority LOW 36
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-71211
  2. 2026-10-03 Alias added: GHSA-qvww-2vwg-9rp6

References

Advisory 2

  • TI-2025-34668 OS command injection in Trend Micro Apex One KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-10115 Insufficient verification of data authenticity in Trend Micro Apex Central KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06895 Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-14867 Unrestricted file upload in Trend Micro Apex One KEVCVSS 3.1HIGH 8.8
  • TI-2020-06795 Injection in Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free… KEVCVSS 3.1HIGH 8.8
  • TI-2020-06794 A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a… KEVCVSS 3.1HIGH 8.8
See all 603 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences