CVE-2025-71211 File upload in TrendAI Apex One

Critical 9.8 Published 21 May 2026 Updated 21 May 2026

Remote attackers with console access can upload malicious code to execute commands on Trend Micro Apex One installations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-71211?

CVE-2025-71211 is a critical vulnerability in Trendmicro Apex One, published on 21 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

Weakness: CWE-22

Which versions are affected by CVE-2025-71211?

It affects 1 product.

Products include Trendmicro Apex One.

How do I fix CVE-2025-71211?

No fix has been published for CVE-2025-71211 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-71211 being exploited?

There is no known exploitation of CVE-2025-71211 in the wild and no public exploit code.

All Trendmicro Apex One vulnerabilities

Sources

Also known as GHSA-qvww-2vwg-9rp6.