ZDI-26-136: Trend Micro Apex One Console Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Apex One console, which listens on TCP ports 8080 and 4343 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of IUSR.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-71210.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ZDI-26-136 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2025-71210 - Compensating control
Restrict network access to the Trend Micro Apex One Console TCP ports 8080 and 4343 (default) so remote attackers cannot reach the console.
Event History
Frequently Asked Questions
What is the severity of ZDI-26-136?
The severity of ZDI-26-136 is critical due to its potential for remote code execution without authentication.
How do I fix ZDI-26-136?
To fix ZDI-26-136, update your Trend Micro Apex One installation to the latest patched version provided by Trend Micro.
What is ZDI-26-136?
ZDI-26-136 is a directory traversal vulnerability in Trend Micro Apex One that allows remote code execution.
Who is affected by ZDI-26-136?
All installations of Trend Micro Apex One are affected by ZDI-26-136 regardless of version.
Is authentication required to exploit ZDI-26-136?
No, authentication is not required to exploit the ZDI-26-136 vulnerability on affected systems.