CVE-2025-54948

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Trend Micro, Inc.	Trend Micro Apex One	>= 2019 (14.0), < 14.0.0.14039

References

https://success.trendmicro.com/en-US/solution/KA-0020652Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54948US Government Resource

Timeline

Published: Aug 5, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Aug 18, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-549499.8A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effec CVE-2025-54959.8A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the compon CVE-2025-549509.8An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code exec CVE-2025-549519.8A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result CVE-2025-549529.8An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potent CVE-2025-549558.1OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can le CVE-2025-549563.2The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the correspondin CVE-2025-549579.8An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is proces CVE-2025-549585.3Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. If this vulnerability is exploited, arbitrary CVE-2025-549595.3Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary f CVE-2025-54963.3ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file CVE-2025-549626.4/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), a