{"meta":{"title":"KEV entries: Trend Micro","description":"All KEV entries for vendor Trend Micro.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":12,"vendor":"Trend Micro","entries":12,"shareOfCatalogPercent":0.7,"ransomwareKnown":0,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-05-21","rank":24},"data":[{"cveID":"CVE-2026-34926","vendorProject":"Trend Micro","product":"Apex One","vulnerabilityName":"Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability","dateAdded":"2026-05-21","dueDate":"2026-06-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-23"],"shortDescription":"Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://success.trendmicro.com/en-US/solution/KA-0023430 ; https://nvd.nist.gov/vuln/detail/CVE-2026-34926","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-34926"},{"cveID":"CVE-2025-54948","vendorProject":"Trend Micro","product":"Apex One","vulnerabilityName":"Trend Micro Apex One OS Command Injection Vulnerability","dateAdded":"2025-08-18","dueDate":"2025-09-08","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://success.trendmicro.com/en-US/solution/KA-0020652 ; N/A ; https://nvd.nist.gov/vuln/detail/CVE-2025-54948","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-54948"},{"cveID":"CVE-2023-41179","vendorProject":"Trend Micro","product":"Apex One and Worry-Free Business Security","vulnerabilityName":"Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability","dateAdded":"2023-09-21","dueDate":"2023-10-12","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://success.trendmicro.com/dcx/s/solution/000294994?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-41179","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-41179"},{"cveID":"CVE-2022-40139","vendorProject":"Trend Micro","product":"Apex One and Apex One as a Service","vulnerabilityName":"Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability","dateAdded":"2022-09-15","dueDate":"2022-10-06","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-353","CWE-641"],"shortDescription":"Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://success.trendmicro.com/dcx/s/solution/000291528?language=en_US;  https://nvd.nist.gov/vuln/detail/CVE-2022-40139","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-40139"},{"cveID":"CVE-2022-26871","vendorProject":"Trend Micro","product":"Apex Central","vulnerabilityName":"Trend Micro Apex Central Arbitrary File Upload Vulnerability","dateAdded":"2022-03-31","dueDate":"2022-04-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-184"],"shortDescription":"An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-26871","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26871"},{"cveID":"CVE-2021-36742","vendorProject":"Trend Micro","product":"Apex One, Apex One as a Service, and Worry-Free Business Security","vulnerabilityName":"Trend Micro Multiple Products Improper Input Validation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://success.trendmicro.com/dcx/s/solution/000287819?language=en_US, https://success.trendmicro.com/dcx/s/solution/000287820?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2021-36742","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-36742"},{"cveID":"CVE-2021-36741","vendorProject":"Trend Micro","product":"Apex One, Apex One as a Service, and Worry-Free Business Security","vulnerabilityName":"Trend Micro Multiple Products Improper Input Validation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://success.trendmicro.com/dcx/s/solution/000287819?language=en_US, https://success.trendmicro.com/dcx/s/solution/000287820?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2021-36741","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-36741"},{"cveID":"CVE-2020-8599","vendorProject":"Trend Micro","product":"Apex One and OfficeScan","vulnerabilityName":"Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-8599","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-8599"},{"cveID":"CVE-2020-8468","vendorProject":"Trend Micro","product":"Apex One, OfficeScan and Worry-Free Business Security Agents","vulnerabilityName":"Trend Micro Multiple Products Content Validation Escape Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-74"],"shortDescription":"Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-8468","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-8468"},{"cveID":"CVE-2020-8467","vendorProject":"Trend Micro","product":"Apex One and OfficeScan","vulnerabilityName":"Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-8467","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-8467"},{"cveID":"CVE-2020-24557","vendorProject":"Trend Micro","product":"Apex One, OfficeScan, and Worry-Free Business Security","vulnerabilityName":"Trend Micro Multiple Products Improper Access Control Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-24557","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-24557"},{"cveID":"CVE-2019-18187","vendorProject":"Trend Micro","product":"OfficeScan","vulnerabilityName":"Trend Micro OfficeScan Directory Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-18187","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-18187"}]}