CVE-2025-71211: A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicio

Q: How do I fix CVE-2025-71211?

apex one: upgrade to 14.0.0.14136, 14.0.20315. Exact commands for each OS are on this page.

Q: Is CVE-2025-71211 being exploited?

CVE-2025-71211 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2025-71211 affect?

CVE-2025-71211 affects apex one. Severity is critical (CVSS 9.8). A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a dif

Q: How urgent is CVE-2025-71211?

Priority 65/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

This week

CRITICAL 9.8REMOTEUPGRADE

CVE-2025-71211 is a critical-severity flaw (CVSS 9.8) affecting apex one. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS

Why this priority

Critical severity
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	3.8% (top 10%)
CISA exploited list	No
Weakness	CWE-22
Published	2026-05-21
Last modified	2026-07-23

Publisher (CNA): Trend Micro, Inc. · Vendor: trendmicro

Last updated 2026-07-23 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-05-21 14:16 UTCPublished CVE record published
2026-07-23 16:10 UTCUpdated Record last modified

trendmicro apex one UPGRADE

Affected: < 14.0.0.14136 · < 14.0.20315

Fixed in: 14.0.0.14136, 14.0.20315

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy apex-one || rpm -q apex-one || apex-one --version

2. UPGRADE to 14.0.0.14136 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade apex-one

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade apex-one

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora ELN · clash-meta · FIXED · 1.19.33-1.eln159 · FEDORA-2026-7dfb64c5e1 · source

sudo dnf upgrade --advisory=FEDORA-2026-7dfb64c5e1

Fedora 46 · vulkan-utility-libraries · FIXED · 1.4.363.0-1.fc46 · FEDORA-2026-994176daf5 · source

sudo dnf upgrade --advisory=FEDORA-2026-994176daf5

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-71211?

apex one: upgrade to 14.0.0.14136, 14.0.20315. Exact commands for each OS are on this page.

Is CVE-2025-71211 being exploited?

CVE-2025-71211 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-71211 affect?

CVE-2025-71211 affects apex one. Severity is critical (CVSS 9.8). A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a dif

How urgent is CVE-2025-71211?

Priority 65/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Trend Micro vulnerabilities

Related CVEs

CVE-2026-34926 MEDIUM 6.7 EXPLOITED UPGRADE Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
CVE-2025-71210 CRITICAL 9.8 UPGRADE A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicio
CVE-2025-71212 HIGH 7.8 UPGRADE A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalat
CVE-2025-71214 HIGH 7.8 MITIGATE An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a l
CVE-2025-71213 HIGH 7.8 UPGRADE An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate priv

References

← Back to latest CVEs