Trend Micro

Vulnerability activity for Trend Micro: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 1
Critical (CVSS 9+): 0
Exploited (CISA KEV): 1
With exploit code: 1

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

6.7MediumMay 21, 2026Trend Micro Apex One Path traversal / file handlingCVE-2026-34926Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.Added to KEV May 21, 2026Exploited13% likelyExploit code
9.4CriticalAug 5, 2025Trend Micro Apex One Code / command injectionCVE-2025-54948Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.Added to KEV Aug 18, 2025 · 12 days after publicationExploited25% likely
7.2HighSep 19, 2023Trend Micro Apex One and Worry-Free Business Security Code / command injectionCVE-2023-41179Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.Added to KEV Sep 21, 2023 · 1 day after publicationExploited4.2% likely
7.2HighSep 19, 2022Trend Micro Apex One and Apex One as a ServiceCVE-2022-40139Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.Added to KEV Sep 15, 2022 · same day as publicationExploited3.4% likely
9.8CriticalMar 29, 2022Trend Micro Apex Central Path traversal / file handlingCVE-2022-26871An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.Added to KEV Mar 31, 2022 · 1 day after publicationExploited19% likely
8.8HighJul 29, 2021Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security Path traversal / file handlingCVE-2021-36741Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.Added to KEV Nov 3, 2021 · 96 days after publicationExploited5% likely
7.8HighJul 29, 2021Trend Micro Apex One, Apex One as a Service, and Worry-Free Business SecurityCVE-2021-36742Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.Added to KEV Nov 3, 2021 · 96 days after publicationExploited1.5% likely
9.8CriticalMar 18, 2020Trend Micro Apex One and OfficeScan Auth bypass / access controlCVE-2020-8599Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.Added to KEV Nov 3, 2021 · 595 days after publicationExploited12% likely
7.8HighSep 1, 2020Trend Micro Apex One, OfficeScan, and Worry-Free Business Security Auth bypass / access controlCVE-2020-24557Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.Added to KEV Nov 3, 2021 · 427 days after publicationExploited2.7% likely
8.8HighMar 18, 2020Trend Micro Apex One, OfficeScan and Worry-Free Business Security Agents Code / command injectionCVE-2020-8468Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.Added to KEV Nov 3, 2021 · 595 days after publicationExploited6.2% likely
8.8HighMar 18, 2020Trend Micro Apex One and OfficeScan Code / command injectionCVE-2020-8467Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.Added to KEV Nov 3, 2021 · 595 days after publicationExploited11% likely
8.8HighOct 28, 2019Trend Micro OfficeScan Path traversal / file handlingCVE-2019-18187Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.Added to KEV Nov 3, 2021 · 736 days after publicationExploited25% likely

Recent

6.7MediumMay 21, 2026Trend Micro Apex One Path traversal / file handlingCVE-2026-34926Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.Exploited13% likelyExploit code
9.4CriticalAug 5, 2025Trend Micro Apex One Code / command injectionCVE-2025-54948Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.Exploited25% likely
7.2HighSep 19, 2023Trend Micro Apex One and Worry-Free Business Security Code / command injectionCVE-2023-41179Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.Exploited4.2% likely
7.2HighSep 19, 2022Trend Micro Apex One and Apex One as a ServiceCVE-2022-40139Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.Exploited3.4% likely
9.8CriticalMar 29, 2022Trend Micro Apex Central Path traversal / file handlingCVE-2022-26871An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.Exploited19% likely
7.8HighJul 29, 2021Trend Micro Apex One, Apex One as a Service, and Worry-Free Business SecurityCVE-2021-36742Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.Exploited1.5% likely
8.8HighJul 29, 2021Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security Path traversal / file handlingCVE-2021-36741Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.Exploited5% likely
9.8CriticalMar 18, 2020Trend Micro Apex One and OfficeScan Auth bypass / access controlCVE-2020-8599Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.Exploited12% likely
8.8HighMar 18, 2020Trend Micro Apex One, OfficeScan and Worry-Free Business Security Agents Code / command injectionCVE-2020-8468Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.Exploited6.2% likely
8.8HighMar 18, 2020Trend Micro Apex One and OfficeScan Code / command injectionCVE-2020-8467Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.Exploited11% likely
7.8HighSep 1, 2020Trend Micro Apex One, OfficeScan, and Worry-Free Business Security Auth bypass / access controlCVE-2020-24557Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.Exploited2.7% likely
8.8HighOct 28, 2019Trend Micro OfficeScan Path traversal / file handlingCVE-2019-18187Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.Exploited25% likely

See every Trend Micro entry on the dashboard.