CVE-2025-54987 is a critical command injection flaw in the on-premise Trend Micro Apex One management console. A pre-authenticated remote attacker can upload malicious code and run commands. Trend Micro's bulletin reports an in-the-wild attempt against one of these flaws and points to Critical Patch build 14081.
What's affected
- Product: Trend Micro Apex One (on-premise) 2019 management server, Windows, English.
- Affected: management server version 14039 and below, per the vendor bulletin.
- Fix: Apex One SP1 Critical Patch build B14081, released on 15 August 2025. A short term fix tool, FixTool_Aug2025, was released first and updated on 6 August 2025.
- Cloud: Apex One as a Service and Trend Vision One Endpoint Security (Standard Endpoint Protection) were mitigated by the vendor in an out of band maintenance on 31 July 2025, with no downtime.
The bulletin describes this CVE as essentially the same as CVE-2025-54948, targeting a different CPU architecture. Treat the two as one patching job.
The fix tool is a stopgap. It protects against known exploits but disables the Remote Install Agent function in the console. Other agent install methods, such as a UNC path or an agent package, are not affected. The Critical Patch restores Remote Install Agent when applied after the tool.
How to check if you're exposed
Check the build number of the management server in the console. Anything at 14039 or below is in the affected range, and the target build is 14081 or higher.
Then check exposure:
- Is the console's IP address reachable from the internet? The bulletin says an attacker must have access to the console, so external exposure raises risk.
- Has the fix tool or the Critical Patch been applied? Confirm on every management server, including disaster recovery copies.
- Review the management server for files and processes you do not recognize, starting from late July 2025.
This is a vendor product, so a dependency scan will not list it. Keep it in your endpoint security inventory with a patch owner.
What to do now
- Apply Apex One SP1 Critical Patch build 14081 on every on-premise management server. Read the readme first.
- If you cannot patch at once, apply the FixTool_Aug2025 mitigation. Note it disables the Remote Install Agent function.
- Restrict the management console to trusted administrator networks, with source address restrictions if it is reachable from outside.
- Review the server for signs of compromise, since Trend Micro reports an exploitation attempt. Look at new executables, web shells and unexpected scheduled tasks.
- If you find evidence of compromise, treat the server as untrusted, rotate credentials the console held, and rebuild from a known good state.
Why it matters
The weakness is OS command injection reachable before login. An endpoint security console is a high value target because it can push software to every managed machine. A flaw that lets an outsider run commands on that server puts the whole fleet in the blast radius, which is why the vendor's own score is 9.4.
The status of exploitation needs careful wording. Trend Micro's bulletin carries an in-the-wild notification saying it observed at least one attempt to actively exploit one of these vulnerabilities. It does not say which of the two CVEs, and the CVE record this article is based on is not flagged in the CISA KEV catalog. Treat the issue as actively targeted and patch accordingly.
The weakness is classed as CWE-78 (OS Command Injection). Severity in the CVE record: critical, CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H).
Try it yourself
Patch status changes quickly after a bulletin like this. This demo shows continuous monitoring catching it.
Click through it at your own pace, or open it full screen.
Quick check
Which build fixes it?
Trend Micro lists Apex One SP1 Critical Patch build B14081 for on-premise management servers. The fix tool is a short term mitigation.
Is this exploited in the wild?
Trend Micro's bulletin says it observed at least one exploitation attempt against one of the two vulnerabilities. The CVE is not listed in the KEV data used for this record, so check CISA directly for current status.
Sources
Last reviewed: 18 October 2026.
