Public Exploit Released: Critical Trend Micro Flaw Grants SYSTEM Access

Trend Micro has issued a critical security alert for users of Apex Central (on-premise), patching a dangerous remote code execution (RCE) vulnerability that could allow attackers to hijack systems with the highest possible privileges.

The flaw, tracked as CVE-2025-69258, carries a critical CVSS score of 9.8. It stems from a “LoadLibraryEX vulnerability” that could allow an unauthenticated remote attacker to load a malicious DLL into a key executable.

According to the bulletin, successful exploitation leads to the “execution of attacker-supplied code under the context of SYSTEM on affected installations”. This means an attacker effectively becomes the puppet master of the server, bypassing all standard security checks without ever needing to log in.

The critical patch also addresses two high-severity Denial of Service (DoS) vulnerabilities, both rated with a CVSS score of 7.5.

• CVE-2025-69259: A “message unchecked NULL return value vulnerability” that allows remote attackers to crash the system.
• CVE-2025-69260: A “message out-of-bounds read vulnerability” that similarly opens the door for attackers to “create a denial-of-service condition on affected installations”.

For both DoS flaws, Trend Micro explicitly warns: “authentication is not required in order to exploit this vulnerability”.

The flaws were responsibly disclosed by Tenable, who also published the technical details and proof-of-concept exploit code for these flaws.

The vulnerabilities affect Apex Central (on-premise) versions below Build 7190 running on Windows.

Trend Micro has released Critical Patch Build 7190 to resolve these issues. While the company notes that an exploit may “require several specific conditions to be met,” they strongly advise against complacency.

“Trend Micro strongly encourages customers to update to the latest builds as soon as possible,” the company recommends.

Related Posts:

• CISA Flags Actively Exploited Trend Micro Apex One Vulnerability (CVE-2025-54948)
• Critical Command Injection Flaws in Trend Micro Apex One Actively Exploited
• Critical Trend Micro Apex Central Flaws: Pre-Auth RCE (CVSS 9.8) Threatens Your Security
• CVE-2023-41179: Critical 0-day Trend Micro Endpoint Security Vulnerability