Vulnerability · Published Jun 17, 2025 · Assigned by trendmicro

CVE-2025-30680

High 7.5

In plain English

A high-severity server-side request forgery in Trend Micro Apex Central from Trend Micro, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 77.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations. Please note: this vulnerability only affects the SaaS instance of Apex Central - customers that automatically apply Trend Micro's monthly maintenance releases to the SaaS instance do not have to take any further action.

Affected products (as reported)

Vendor	Product	Versions
Trend Micro, Inc.	Trend Micro Apex Central	SaaS – before 8.0.6955

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

In plain English

Official description

Affected products (as reported)

References