CVE-2025-47867 is a high severity local file inclusion flaw (CVSS 7.5) in a widget of Trend Micro Apex Central on Windows, before build 6955. The record says it could lead to remote code execution. Trend Micro lists build 6955 as the fix for the on premises product.
What's affected
The record says Trend Micro Apex Central versions below 8.0.6955 are affected. Trend Micro's security bulletin KA-0019355 lists the on premises product as affected before build 6955 on Windows, and the SaaS version as affected before its March 2025 maintenance release. It lists build 6955 and that maintenance release as the solutions, both now available.
The record describes a local file inclusion in an Apex Central widget that could include arbitrary files to run as PHP code, leading to remote code execution.
The vector shows network access with high attack complexity, low privileges and no user interaction. Confidentiality, integrity and availability impact are all high. The privilege requirement means an attacker needs a valid low level account first. The record does not mark the flaw as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
The record does not mark it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Open the Apex Central console and check the product version and build under the About or product information page. On the server, you can also check the installed program version in Windows settings.
If the build is lower than 6955, you are in the affected range. SaaS customers should confirm that the March 2025 monthly maintenance release or later has been applied, which the vendor normally handles.
Read Trend Micro's bulletin for the full list of fixed issues. The bulletin is titled April 2025 and covers several Apex Central CVEs, so one upgrade may close more than this one.
What to do now
- Check your Apex Central build number.
- Back up the server and the database.
- Install build 6955 or the latest build from the Trend Micro Download Center, following the vendor readme.
- Limit access to the console to administrators and management networks.
- Review the list of accounts with console access, and remove those no longer needed.
- Check the server for unexpected files or processes if the console was exposed to a wide network before patching.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record lists CWE-74, injection. File inclusion flaws let a program load a file chosen by someone else and run it as code. When that happens inside a management console, the effect can reach every endpoint the console manages, which is why high impact scores are recorded here.
The Zero Day Initiative published a related advisory, ZDI-25-297, which the record lists as a reference. Security tools are themselves software and need patching on the same schedule as other systems. A console that manages other machines should sit on a restricted network with strong authentication.
Quick check
What build fixes CVE-2025-47867?
Trend Micro lists build 6955 for the on premises product and the March 2025 monthly maintenance release for SaaS.
Is this flaw exploited in the wild?
The record does not say so, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Sources
- Gold page for CVE-2025-47867
- Trend Micro security bulletin KA-0019355
- Zero Day Initiative ZDI-25-297
Last reviewed: 18 October 2026.
