**Trend Micro Fixes Critical Vulnerability in Apex Central**

Trend Micro has addressed a critical vulnerability in its Apex Central management console, which could have allowed remote code execution or denial-of-service attacks.

The cybersecurity firm patched three flaws (CVE-2025-69258, CVE-2025-69259, and CVE-2025-69260) discovered by Tenable researchers, which could enable an unauthenticated attacker to execute malicious code as SYSTEM on affected installations. The most severe issue is a LoadLibraryEX remote code execution (RCE) vulnerability tracked as CVE-2025-69258, with a CVSS score of 9.8.

"A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations," reads the advisory published by Tenable.

An unauthenticated attacker can trigger the flaw to load a malicious DLL and execute code as SYSTEM on vulnerable systems. The report published by Tenable includes PoC exploit code that demonstrates how an attacker can send message 0x0a8d to load an attacker-controlled DLL into MsgReceiver.exe, leading to execution of attacker-supplied code under the security context of SYSTEM.

The other vulnerabilities addressed by Trend Micro are respectively an unchecked NULL return value Denial of Service (DoS) issue and a message out-of-bounds read Denial of Service (DoS) flaw. These flaws can be exploited by unauthenticated attackers, but typically require access to a vulnerable system.

Trend Micro urges customers to promptly apply patches, limit remote access, and keep security controls up to date to mitigate the risks associated with these vulnerabilities. The company addressed the flaws in its latest product release:

**August 2025 Product Release**

Trend Micro released fixes for two critical vulnerabilities (CVE-2025-54948 and CVE-2025-54987) in Apex One on-prem consoles, which had a CVSS score of 9.4. The company confirmed that both issues were actively exploited in the wild.

Both vulnerabilities are command injection remote code execution (RCE) issues on Apex One Management Console (on-premise). "Trend Micro has observed at least one instance of an attempt to actively exploit one of these vulnerabilities in the wild," reads the advisory published by the company.

Trend Micro did not publish details about the attacks exploiting these vulnerabilities. In June, the company fixed multiple vulnerabilities that impact its Apex Central and Endpoint Encryption (TMEE) PolicyServer products.

Stay up-to-date with the latest security news and trends by following me on Twitter: @securityaffairs and Facebook and Mastodon.