CVE-2025-69260 Denial of service in Trend Micro Apex Central
A remote attacker can cause a denial-of-service condition in Trend Micro Apex Central via an out-of-bounds read without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-69260?
CVE-2025-69260 is a high-severity denial of service vulnerability in Trend Micro Apex Central, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.
Which versions are affected by CVE-2025-69260?
It affects 1 product.
Products include Trendmicro Apex Central.
How do I fix CVE-2025-69260?
No fix has been published for CVE-2025-69260 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-69260 being exploited?
There is no known exploitation of CVE-2025-69260 in the wild and no public exploit code.
Other vulnerabilities in Trend Micro Apex Central
Sources
Also known as GHSA-p5v2-mqcc-2j93.