Trend Micro Apex One Critical RCE Flaws Expose Systems
Cybersecurity firm Trend Micro issued urgent patches on February 24, 2026, for its Apex One endpoint protection platform after secuirity team uncovered eight vulnerabilities, including two critical remote code execution (RCE) flaws.
These issues, tracked as CVE-2025-71210 through CVE-2025-71217, affect on-premises Windows installations and some SaaS versions for Windows and Mac. With CVSS scores ranging from 7.2 to 9.8, the bugs pose serious threats, from remote command execution to local privilege escalation.
The most alarming are two directory traversal vulnerabilities in the Apex One management console. Attackers could exploit them without authentication to upload and run malicious code.
While SaaS editions received mitigations earlier, on-prem users with exposed consoles face immediate risks. Local flaws, meanwhile, let low-privileged attackers climb to root access via symlink tricks, validation slips, and timing attacks.
| CVE ID | CVSS Score | Severity | Type | Platform | Key Requirement |
|---|---|---|---|---|---|
| CVE-2025-71210 | 9.8 | Critical | Console RCE (Traversal) | Windows | Network access to the console |
| CVE-2025-71211 | 9.8 | Critical | Console RCE (Traversal) | Windows | Network access to console |
| CVE-2025-71212 | 7.8 | High | Scan engine priv esc | Windows | Local low-priv execution |
| CVE-2025-71213 | 7.8 | High | Origin validation esc | Windows | Local low-priv execution |
| CVE-2025-71214 | 7.2 | High | iCore origin esc | Mac | Local low-priv + interaction |
| CVE-2025-71215 | 7.8 | High | iCore TOC/TOU esc | Mac | Local low-priv execution |
| CVE-2025-71216 | 7.8 | High | Cache TOC/TOU esc | Mac | Local low-priv execution |
| CVE-2025-71217 | 7.8 | High | Self-protect esc | Mac | Local low-priv execution |
All flaws stem from responsible disclosures via the Zero Day Initiative (ZDI). The patch bundle also bolsters defenses against prior issues (CVE-2025-54987 and CVE-2025-54948) through enhancements tagged ZDI-CAN-27975 and 27976.
Affected Systems and Patch Details
On-prem Apex One 2019 (Windows, English) bears the brunt, alongside SaaS variants like Apex One as a Service and Trend Vision One Endpoint Standard Endpoint Protection (Windows, English). Mac issues are informational, fixed in mid-2025 SaaS releases (2507 and 2005).
- Apex One (Windows): Critical Patch Build 14136. Download: apexone_sp1_win_en_criticalpatch_b14136.exe
- Apex One as a Service / Trend Vision One (Windows): Security Agent Build 14.0.20315
How Apex Exposed
Imagine an exposed Apex One console common in hybrid setups. For CVE-2025-71210 and 71211, a remote foe crafts a malicious upload via directory traversal (CWE-22), slipping past path checks like tricks to drop payloads in executable spots.
No login needed (PR: N), and low complexity (AC:L) means scripts could automate it. Once in, full system compromise follows: data theft, lateral movement, or ransomware drops.
Local bugs demand a foothold first, say, via phishing. CVE-2025-71212 (CWE-59) exploits symlink races in the scan engine, hijacking files during processing.
Mac flaws like CVE-2025-71215 and 71216 weaponize TOC/TOU (CWE-367) races: check a file’s integrity, then swap it microseconds later for a malicious twin, escalating to root.
These aren’t zero-days in the wild yet, but chained with initial access (e.g., unpatched RDP), they amplify breaches. Think SolarWinds scale supply chain worry, but endpoint-focused.
What to do Next
Unlike rote advisories, these flaws highlight persistent pains in endpoint agents: consoles as juicy targets, races in high-trust services. Mac patches flew under radars in 2025 updates, a reminder to automate agent checks.
Immediate Steps:
- Patch on-prem to Build 14136 ASAP.
- Lock console IPs: whitelist sources, firewall externally.
- Audit low-priv access; enforce least privilege.
- Scan for exposures with tools like Nuclei or custom ZDI PoCs (when public).
- Review logs for traversal attempts (e.g., “../” in uploads).
Attackers need access, but don’t bet on it; perimeter slips happen. Trend Micro urges swift updates amid rising endpoint hunts by groups like LockBit.
Site: https://cybersecuritypath.com
About the Author
