CISA has issued a warning about a serious “OS command injection” vulnerability in the Trend Micro Apex One management console, placing it on the List of Known Exploitable Vulnerabilities (KEV). According to the agency, malicious actors are actively exploiting the vulnerability.
The vulnerability, tracked as CVE-2025-54948, poses significant risks to organizations using on-premise installations of the security platform.
Trend Micro Apex One: OS Command Injection Vulnerability
This command injection flaw allows malicious actors to upload arbitrary code and execute system commands on compromised installations, potentially leading to a complete system compromise.
See also: CISA warns of PaperCut RCE vulnerability exploitation
The vulnerability arises from inadequate input control in the management console interface. As a result, attackers can inject malicious OS commands via specially crafted requests. At the same time, attackers bypass security mechanisms and gain unauthorized access to sensitive systems.
The pre-authentication nature of the exploit makes it particularly concerning, as attackers do not need valid credentials to exploit the vulnerability.
Trend Micro Apex One: CVE-2025-54948
| Risk Factors | Details |
| Affected Products | Trend Micro Apex One Management Console (on-premise installations) |
| Consequences | Remote code execution, arbitrary command execution |
| Exploitation prerequisites | Pre-authenticated remote access |
| CVSS 3.1 Score | 9.8 (Critical) |
CISA added CVE-2025-54948 to the Known Exploited Vulnerabilities on August 18, 2025. Federal agencies must apply the updates by September 8, 2025.
See also: CISA warns of SysAid vulnerability exploitation
The organization recommends that the supplier implement the mitigations proposed immediately. Otherwise, they should completely discontinue use of the affected products.
While it remains unknown whether this vulnerability has been used in ransomware campaigns, the fact that it is being actively exploited shows that advanced malicious actors are not wasting time.
Organizations should prioritize patching and implement additional controls network segmentation around Trend Micro Apex One installations (as a temporary protective measure).
Trend Micro has published security advisories and mitigation guidance through technical support channels.
See also: Citrix Bleed 2: Added to CISA's KEV List
System administrators should immediately review Apex One Management Console installations, apply available security updates , and monitor for suspicious authentication attempts or unusual system execution commands.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
This vulnerability again shows the pattern:
- security solutions can themselves become entry points when they have zero-days or critical bugs,
- organizations should treat management consoles as particularly sensitive targets,
- and responding quickly to CISA advisories is now a matter of operational survival.
CISA, by placing CVE on the KEV List, sends a clear message:
- Patching is not optional. There is a strict deadline for federal agencies, but private organizations should move just as quickly.
- The workaround is useful, but it does not replace the patch.
CISA KEV List and Active Vulnerabilities
CISA's KEV list is very useful for organizations around the world who want to learn about new threats and are interested in better vulnerability management and prioritization.
Overall, CISA helps a lot in protecting and addressing cybersecurity threats. This organization works with various sectors, such as private businesses, state governments, and local authorities, to improve the security of digital systems.
It provides information and tools to help organizations protect their networks from cyberattacks and respond to any attacks that may occur. It also informs the public about any vulnerabilities in widely used systems and applications. Overall, CISA's role is vital to protecting the digital infrastructure of the United States and other regions.
Source: cybersecuritynews.com
