An attacker that reaches the Trend Micro Apex One management console can upload arbitrary code and then execute system commands. The flaw bypasses normal file‑upload controls, allowing a path traversal style injection (CWE‑22). Successful exploitation would give the attacker full control over the host machine, compromising confidentiality, integrity, and availability of the protected environment.

The vulnerability affects Trend Micro Apex One 14.0.0.14136 for on‑premises deployments and the Apex One as a Service product 14.0.0.20315. The SaaS instance has already been patched, so service carriers have no action to take, while on‑premises installations remain exposed.

The CVSS rating of 9.8 marks this flaw as critical. No EPSS score is published, but the vulnerability is not listed in the CISA KEV catalog, which suggests it is not actively exploited in the wild yet. However, the attacker must have network reach to the Management Console; if the console’s IP is exposed externally, the threat becomes immediate. Source restrictions or VPN isolation are effective mitigations to reduce attack surface.