- Trend Micro patched two critical Apex One path traversal flaws (CVE-2025-71210, CVE-2025-71211, both 9.8/10)
- Exploitation requires console access
- SaaS version fixed, on-prem patch Build 14136 released
Trend Micro says it has patched two critical vulnerabilities which could have allowed threat actors to take over vulnerable underlying systems.
In a security advisory, the company said it fixed a path traversal vulnerability in the Trend Micro Apex One management console, which is now tracked as CVE-2025-71210, and which was given a critical severity score of 9.8/10.
The second bug is similar in nature – a path traversal flaw in the Apex One management console, but since it affects a different executable, it is tracked as CVE-2025-71211. This one was also given a critical severity rating of 9.8/10.
Patches and defenses
Apex One is an endpoint security platform for business computers, servers, and other devices, designed to shield them from malware, ransomware, spyware, and other cyberthreats. It combines traditional antivirus with modern threat-detection technologies like machine learning and behavioral analysis and comes with centralized management and investigation tools.
Defending against potential attacks is relatively easy. As Trend Micro explained in the advisory, to exploit it, an attacker “must have access to the Trend Micro Apex One Management Console, so customers that have their console’s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.”
“Even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to update to the latest builds as soon as possible,” it warned.
The SaaS Apex One version has already been fixed, and the company released Critical Patch Build 14136 for on-prem customers. This patch also fixes additional two vulnerabilities in the Windows agent, and four in the macOS agent.
At press time, there was no evidence of these flaws being abused in the wild, and the US CISA has not yet added them to its Known Exploited Vulnerabilities (KEV) catalog.
Via BleepingComputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.
https://cdn.mos.cms.futurecdn.net/MgHkR3uwBsnpbGtik3QxwF-1920-80.jpg
Source link
