Trend Micro Apex Central RCE Flaw Scores 9.8 CVSS in On-Prem Windows Versions

Summary: Trend Micro released security updates for on-premise Apex Central for Windows addressing three vulnerabilities, including CVE-2025-69258, a LoadLibraryEX remote code execution flaw with a CVSS score of 9.8 out of 10.0 that could let an unauthenticated remote attacker load an attacker-controlled DLL into a key executable and run code as SYSTEM, with all three flaws identified by Tenable in August 2025 and affecting versions below Build 7190.
Bottom line: An unauthenticated attacker who reaches the MsgReceiver.exe process on its default TCP port 20001 can send a crafted message and execute code as SYSTEM, so any Apex Central instance below Build 7190 that is reachable from outside is the exposure to close first.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-69258 CVE-2025-69259 CVE-2025-69260
Related: ⚡ Weekly Recap: AI Automation Exploits, Telecom Espionage, Prompt Poaching & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026