Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN014
_____________________________________________________________________

DATE                : 09/01/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems Apex Central (on-premise) versions prior
                             to Critical Patch Build 7190.

=====================================================================
https://success.trendmicro.com/en-US/solution/KA-0022071
_____________________________________________________________________

CRITICAL SECURITY BULLETIN: Trend Micro Apex Central (on-premise)
January 2026 Multiple Vulnerabilities

Product / Version includes:

Apex Central 2019 , Apex Central All

Last updated:   2026/01/07
Solution ID:   KA-0022071
Category:  

Summary
Release Date: January 7. 2026

CVE Identifiers: CVE-2025-69258, CVE-2025-69259, CVE-2025-69260
Platform: Windows
CVSS 3.0 Score(s): 7.5 - 9.8
Weakness ID(s): CWE-1285, CWE-306, CWE-641
Severity Rating(s): HIGH - CRITICAL
 
Trend Micro has released a new Critical Patch (CP) for Trend Micro
Apex Central (on-premise) that resolves multiple vulnerabilities.
 

Affected Version(s)

Product 	Affected Version(s)  	Platform  	Language(s) 
Apex Central (on-premise)    Versions below Build 7190    Windows
English


Solution

Trend Micro has released the following solutions to address the
issue:

Product      Updated version     Notes    Platform   Availability
 
Apex Central (on-premise)    Critical Patch Build 7190   Readme
Windows    Now Available 

These are the minimum recommended version(s) of the patches and/or
builds required to address the issue. Trend Micro highly
encourages customers to obtain the latest version of the product
if there is a newer one available than the one listed in this
bulletin.

Customers are encouraged to visit Trend Micro’s Download Center
to obtain prerequisite software (such as Service Packs) before
applying any of the solutions above.

Vulnerability Details

CVE-2025-69258: LoadLibraryEX Remote Code Execution (RCE) Vulnerability 
CVSSv3.1: 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A LoadLibraryEX vulnerability in Trend Micro Apex Central could
allow an unauthenticated remote attacker to load an
attacker-controlled DLL into a key executable, leading to execution
of attacker-supplied code under the context of SYSTEM on affected
installations.
 

CVE-2025-69259:  Message Unchecked NULL Return Value Denial of
Service (DoS) Vulnerability 
CVSSv3.1: 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A message unchecked NULL return value vulnerability in
Trend Micro Apex Central could allow a remote attacker to
create a denial-of-service condition on affected installations.

Please note: authentication is not required in order to

exploit this vulnerability.

CVE-2025-69260:  Message Out-of-bounds Read Denial of
Service (DoS) Vulnerability 
CVSSv3.1: 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A message out-of-bounds read vulnerability in Trend Micro
Apex Central could allow a remote attacker to create a
denial-of-service condition on affected installations.

Please note: authentication is not required in order to
exploit this vulnerability.


Mitigating Factors

Exploiting these type of vulnerabilities generally require
that an attacker has access (physical or remote) to a
vulnerable machine. In addition to timely application of
patches and updated solutions, customers are also advised
to review remote access to critical systems and ensure
policies and perimeter security is up-to-date.

However, even though an exploit may require several specific
conditions to be met, Trend Micro strongly encourages
customers to update to the latest builds as soon as possible.


Acknowledgement

Trend Micro would like to thank the following
individuals/organizations for responsibly disclosing these
issues and working with Trend Micro to help protect our
customers:

    Tenable


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================