Trend Micro flaws being used in attacks
CISA lists 12 flaws in Trend Micro products as being used in attacks, most recently on 21 May 2026.
Trend MicroBeing used in attacks
- On CISA’s list
- 12 flaws, added between 3 Nov 2021 and 21 May 2026
- Most recent
- CVE-2026-34926, Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability, added 21 May 2026
- Used in ransomware
- None known to CISA
- Products
- Apex One (2), Apex One and OfficeScan (2), Apex One, Apex One as a Service, and Worry-Free Business Security (2), Apex Central (1), Apex One and Apex One as a Service (1), and 4 more
What to do
- Update every Trend Micro product you use.Install the updates Trend Micro offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Trend Micro Apex One
CVE-2026-34926Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityTrend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Trend Micro Apex One
CVE-2025-54948Trend Micro Apex One OS Command Injection VulnerabilityTrend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Trend Micro Apex One and Worry-Free Business Security
CVE-2023-41179Trend Micro Apex One and Worry-Free Business Security Remote Code Execution VulnerabilityTrend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Trend Micro Apex One and Apex One as a Service
CVE-2022-40139Trend Micro Apex One and Apex One as a Service Improper Validation VulnerabilityTrend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.CISA’s required actionApply updates per vendor instructions. - Trend Micro Apex Central
CVE-2022-26871Trend Micro Apex Central Arbitrary File Upload VulnerabilityAn arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.CISA’s required actionApply updates per vendor instructions. - Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security
CVE-2021-36742Trend Micro Multiple Products Improper Input Validation VulnerabilityTrend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security
CVE-2021-36741Trend Micro Multiple Products Improper Input Validation VulnerabilityTrend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.CISA’s required actionApply updates per vendor instructions. - Trend Micro Apex One, OfficeScan, and Worry-Free Business Security
CVE-2020-24557Trend Micro Multiple Products Improper Access Control VulnerabilityTrend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.CISA’s required actionApply updates per vendor instructions. - Trend Micro Apex One and OfficeScan
CVE-2020-8599Trend Micro Apex One and OfficeScan Authentication Bypass VulnerabilityTrend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.CISA’s required actionApply updates per vendor instructions. - Trend Micro Apex One, OfficeScan and Worry-Free Business Security Agents
CVE-2020-8468Trend Micro Multiple Products Content Validation Escape VulnerabilityTrend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.CISA’s required actionApply updates per vendor instructions. - Trend Micro Apex One and OfficeScan
CVE-2020-8467Trend Micro Apex One and OfficeScan Remote Code Execution VulnerabilityTrend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Trend Micro OfficeScan
CVE-2019-18187Trend Micro OfficeScan Directory Traversal VulnerabilityTrend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Trend Micro on CISA’s site.