ZDI-26-137: Trend Micro Apex One Console Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Apex One console, which listens on TCP ports 8080 and 4343 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of IUSR.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-71211.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ZDI-26-137 - Compensating control
Restrict network access to the Trend Micro Apex One Console ports 8080 and 4343 (default listening ports) to trusted sources (e.g., allow only required management IPs) until the console is patched.
Event History
Frequently Asked Questions
What is the severity of ZDI-26-137?
ZDI-26-137 has been assigned a critical severity rating due to its potential for remote code execution without authentication.
How do I fix ZDI-26-137?
To fix ZDI-26-137, update your Trend Micro Apex One to the latest version that addresses this vulnerability.
What exploit methods are associated with ZDI-26-137?
ZDI-26-137 can be exploited via a directory traversal attack that allows remote code execution.
What versions of Trend Micro Apex One are affected by ZDI-26-137?
ZDI-26-137 affects all versions of Trend Micro Apex One that are not updated with the security patch.
Is authentication required to exploit ZDI-26-137?
No, ZDI-26-137 can be exploited without any authentication, making it particularly dangerous.