ZDI 2026-03-03

ZDI-26-146: Trend Micro Apex Central Manual Update Server-Side Request Forgery Vulnerability

CVE-2025-71207

Machine-generated analysis · WAYSCloud LLM

The vulnerability requires authentication and could allow remote information disclosure via a server-side request forgery (SSRF) in Trend Micro Apex Central.

Context

Trend Micro Apex Central is affected by a vulnerability in its Manual Update functionality. The issue is a server-side request forgery (SSRF) that may allow authenticated remote attackers to disclose sensitive information. The advisory notes that authentication is required to exploit the vulnerability. Worth noting is that the CVSS score is rated at 4.4, indicating a medium severity impact.

Operator considerations

Check: Verify if Trend Micro Apex Central with Manual Update functionality is deployed and exposed to untrusted networks.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.4. The following CVEs are assigned: CVE-2025-71207.

Read the full advisory on ZDI →