CVE-2025-71210 Path traversal in TrendAI Apex One

Critical 9.8 Published 21 May 2026 Updated 21 May 2026

Remote attackers with console access can upload malicious code and execute commands via path traversal in Trend Micro Apex One.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-71210?

CVE-2025-71210 is a critical path traversal vulnerability in Trendmicro Apex One, published on 21 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

Weakness: CWE-22

Which versions are affected by CVE-2025-71210?

It affects 1 product.

Products include Trendmicro Apex One.

How do I fix CVE-2025-71210?

No fix has been published for CVE-2025-71210 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-71210 being exploited?

There is no known exploitation of CVE-2025-71210 in the wild and no public exploit code.

All Trendmicro Apex One vulnerabilities

Sources

Also known as GHSA-vhc8-fg3x-3rvc.