This vulnerability (CVE-2025-71210) affects Trend Micro Apex One management console 2019 (14.0) and involves CWE-22, improper limitation of a pathname to a restricted directory. It allows remote attackers with access to the management console to upload malicious code and execute arbitrary commands. The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The SaaS version is already mitigated by the vendor, but on-premises installations may remain vulnerable if the console is exposed externally.

Successful exploitation can lead to full compromise of the affected Apex One management console, including remote code execution with high impact on confidentiality, integrity, and availability. This could allow attackers to control the security management environment, potentially undermining endpoint protection. However, exploitation requires access to the management console interface, which limits exposure to environments where the console is externally accessible without proper access controls.

The vendor has mitigated this vulnerability for SaaS versions of Apex One, requiring no customer action in those environments. For on-premises installations, no official patch or remediation has been published yet. Customers should restrict external access to the management console IP address and apply source IP restrictions or network-level controls to limit access. Monitor vendor advisories for official patches or updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.