Apex Central vulnerabilities
17 known vulnerabilities in Apex Central from Trend Micro. 17 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Trend Micro Apex Central: Out-of-bounds Read
A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.
- 7.5 High severity
Trend Micro Apex Central: NULL Pointer Dereference
A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.
- 9.8 Critical severity
Trend Micro Apex Central: Buffer Copy without Checking Size of Input
A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installati
- 7.1 High severity
Trend Micro Apex Central: Server-Side Request Forgery
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations. Please note: this vulnerability only affects the SaaS in
- 7.5 High severity
Trend Micro Apex Central: Server-Side Request Forgery
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
- 7.5 High severity
Trend Micro Apex Central: Server-Side Request Forgery
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
- 9.8 Critical severity
Trend Micro Apex Central: Deserialization of Untrusted Data
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
- 9.8 Critical severity
Trend Micro Apex Central: Deserialization of Untrusted Data
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method
- 9.8 Critical severity
Trend Micro Apex Central: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations.
- 7.5 High severity
Trend Micro Apex Central: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
- 9.8 Critical severity
Trend Micro Apex Central: Undefined Behavior for Input to API
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.
- 7.1 High severity
Trend Micro Apex Central: Server-Side Request Forgery
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged cod
- 7.5 High severity
Trend Micro Apex Central: Improper Control of Filename for Include/Require Statement in PHP Program
A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations. Please note: this vulnerability must be used in conjunction with another one to exploit an affe
- 8.8 High severity
Trend Micro Apex Central: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations. Please note: although authentication is required to exploit this vulnerability, this vulnerability could be
- 8.8 High severity
Trend Micro Apex Central: Improper Neutralization of Special Elements used in an SQL Command
Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution. Please note: an attacker must first obtain authentication on the targ
- 8.8 High severity
Trend Micro Apex Central: Improper Neutralization of Special Elements used in an SQL Command
Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution. Please note: an attacker must first obtain authentication on the targ
- 9.8 Critical severity
Trend Micro Apex Central Arbitrary File Upload Exploited
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.