Trend Micro Known Exploited Vulnerabilities
Evidence-backed KEV intelligence for Trend Micro products — CISA KEV status, confidence, sensor telemetry, and virtual-patch availability.
Total KEVs
12
In CISA KEV
12
Beyond CISA KEV
0
Sensor Observed
0
Virtual Patch Available
0
Trend Micro KEVs Added by Year
12 Trend Micro KEVs added all time (primary attestation date).
Attested CVEs
| CVE | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-34926
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the... |
TrendAI Apex One, TrendAI Apex One as a Service | Confirmed | In CISA | 01 Jun 2026 |
|
CVE-2025-54948
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code... |
Trend Micro Apex One | Confirmed | In CISA | 01 Jun 2026 |
|
CVE-2021-36741
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1... |
Trend Micro Apex One, Trend Micro OfficeScan, Trend Micro Worry-Free Business Security | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2021-36742
A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1... |
Trend Micro Apex One, Trend Micro OfficeScan, Trend Micro Worry-Free Business Security | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2020-8599
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an... |
Trend Micro OfficeScan, Trend Micro Apex One | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2020-24557
A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a... |
Trend Micro Apex One, Trend Micro Worry-Free Business Security | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2020-8468
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape... |
Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS) | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2020-8467
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute... |
Trend Micro OfficeScan, Trend Micro Apex One | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2019-18187
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files... |
Trend Micro OfficeScan | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2022-26871
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which... |
Trend Micro Apex Central | Confirmed | In CISA | 31 Mar 2022 |
|
CVE-2022-40139
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could... |
Trend Micro Apex One | Confirmed | In CISA | 15 Sep 2022 |
|
CVE-2023-41179
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and... |
Trend Micro Apex One, Trend Micro Worry-Free Business Security, Trend Micro Worry-Free Business Security Services | Confirmed | In CISA | 21 Sep 2023 |
Common Vulnerability Classes (CWE)
- CWE-20 — Improper Input Validation 1
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 1
- CWE-23 — Relative Path Traversal 1
- CWE-345 — Insufficient Verification of Data Authenticity 1
- CWE-434 — Unrestricted Upload of File with Dangerous Type 1
- CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') 1
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 1
- CWE-94 — Improper Control of Generation of Code ('Code Injection') 1
Browse all known exploited vulnerabilities · What is a known exploited vulnerability? · Methodology