Trend Micro vulnerabilities in CISA KEV
Trend Micro has 12 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 24th highest of any vendor. 1 was added in the last 12 months; none are linked to known ransomware use (0% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 14 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Apex One, with 2 entries. Other frequently affected products: Apex One and OfficeScan (2); Apex One, Apex One as a Service, and Worry-Free Business Security (2).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor trend-micro --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
12
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-05-21
most recent entry
┌─ last 12 months
1
entries added
┌─ ransomware use
0 of 12
0% linked to ransomware
┌─ distinct products
9
affected products
$ awk -F, {print $1} /var/log/kev/trend-micro.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 7 | 0 |
| 2022 | 2 | 0 |
| 2023 | 1 | 0 |
| 2025 | 1 | 0 |
| 2026 | 1 | 0 |
$ sort /var/log/kev/trend-micro.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Apex One 2 entries
- Apex One and OfficeScan 2 entries
- Apex One, Apex One as a Service, and Worry-Free Business Security 2 entries
- Apex Central 1 entry
- Apex One and Apex One as a Service 1 entry
$ kev-due-dates --vendor trend-micro
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Trend Micro
21 days (range 14 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/trend-micro.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (8 of 12 have at least one CWE).
$ grep -ril 'Trend Micro' /var/log/news | head -5
Our reporting that names Trend Micro or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./trend-micro.kev · 12 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-34926
Apex One
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
due 2026-06-04 · CWE-23
$ cat CVE-2026-34926.txt
Description. Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-54948
Apex One
Trend Micro Apex One OS Command Injection Vulnerability
due 2025-09-08 · CWE-78
$ cat CVE-2025-54948.txt
Description. Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2023-41179
Apex One and Worry-Free Business Security
Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability
due 2023-10-12
$ cat CVE-2023-41179.txt
Description. Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2022-40139
Apex One and Apex One as a Service
Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability
due 2022-10-06 · CWE-353 CWE-641
$ cat CVE-2022-40139.txt
Description. Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2022-26871
Apex Central
Trend Micro Apex Central Arbitrary File Upload Vulnerability
due 2022-04-21 · CWE-184
$ cat CVE-2022-26871.txt
Description. An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2019-18187
OfficeScan
Trend Micro OfficeScan Directory Traversal Vulnerability
due 2022-05-03 · CWE-22
$ cat CVE-2019-18187.txt
Description. Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-24557
Apex One, OfficeScan, and Worry-Free Business Security
Trend Micro Multiple Products Improper Access Control Vulnerability
due 2022-05-03
$ cat CVE-2020-24557.txt
Description. Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2020-8467
Apex One and OfficeScan
Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
due 2022-05-03
$ cat CVE-2020-8467.txt
Description. Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-8468
Apex One, OfficeScan and Worry-Free Business Security Agents
Trend Micro Multiple Products Content Validation Escape Vulnerability
due 2022-05-03 · CWE-74
$ cat CVE-2020-8468.txt
Description. Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.
Required action. Apply updates per vendor instructions.
- CVE-2020-8599
Apex One and OfficeScan
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
due 2022-05-03
$ cat CVE-2020-8599.txt
Description. Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.
Required action. Apply updates per vendor instructions.
- CVE-2021-36741
Apex One, Apex One as a Service, and Worry-Free Business Security
Trend Micro Multiple Products Improper Input Validation Vulnerability
due 2021-11-17 · CWE-22
$ cat CVE-2021-36741.txt
Description. Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.
Required action. Apply updates per vendor instructions.
- CVE-2021-36742
Apex One, Apex One as a Service, and Worry-Free Business Security
Trend Micro Multiple Products Improper Input Validation Vulnerability
due 2021-11-17 · CWE-20
$ cat CVE-2021-36742.txt
Description. Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.
Required action. Apply updates per vendor instructions.