TrendMicro Apex One

Trend Micro Apex One RCE via Pre-Auth Console Upload
CVE-2025-54987 9.8 - Critical - August 05, 2025

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture.

Trend Micro Apex One pre-auth upload
CVE-2025-54948 9.4 - Critical - August 05, 2025

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

Shell injection

Local Privilege Escalation via Link-Follow in Apex One Damage Cleanup Engine
CVE-2025-49157 - June 17, 2025

A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVE-2025-49154: Trend Micro Apex One Local Access Control Exploit
CVE-2025-49154 - June 17, 2025

An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One DLP Uncontrolled Search Path Allows Xec
CVE-2025-49155 - June 17, 2025

An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.

Priv Esc via Link Follow in Trend Micro Apex One Scan Engine
CVE-2025-49156 - June 17, 2025

A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One UI Manager Bypass Allows Local Execution
CVE-2024-58105 7.8 - High - March 25, 2025

A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. This CVE address an addtional bypass not covered in CVE-2024-58104. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One UI Manager LPE & Code Exec
CVE-2024-58104 7.8 - High - March 25, 2025

A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One: Local Privilege Escalation via Engine Link Following
CVE-2024-55631 - December 31, 2024

An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One Security Agent Link Following Privilege Escalation Vulnerability
CVE-2024-55632 - December 31, 2024

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One Origin Validation Error Privilege Escalation
CVE-2024-55917 - December 31, 2024

An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One widget LFI allows RCE
CVE-2024-52047 8.8 - High - December 31, 2024

A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One LogServer Local Escalation via File Creation
CVE-2024-52050 - December 31, 2024

A LogServer arbitrary file creation vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One modOSCE SQLi Allows RCE
CVE-2024-39753 - October 22, 2024

An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro APEX One Agent TOCTOU Privilege Escalation
CVE-2024-36304 7 - High - June 10, 2024

A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Apex One LPE via Link-Follow Exploit (CVE-2024-36305)
CVE-2024-36305 7.8 - High - June 10, 2024

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

insecure temporary file

Trend Micro Apex One PrivEsc via Origin Validation (CVE-2024-36303)
CVE-2024-36303 7.8 - High - June 10, 2024

An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2024-36302.

Origin Validation Error

Local attacker can obtain agent info via link following in Trend Micro Apex One
CVE-2024-36307 5.5 - Medium - June 10, 2024

A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information about the agent on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One: Origin Validation flaw -> LPE
CVE-2024-36302 7.8 - High - June 10, 2024

An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2024-36303.

Trend Micro Apex One Local Privilege Escalation via Access Control Bypass
CVE-2024-37289 7.8 - High - June 10, 2024

An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Local DoS via link following in Trend Micro Apex One DAMAGE Cleanup Engine
CVE-2024-36306 5.5 - Medium - June 10, 2024

A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to create a denial-of-service condition on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

insecure temporary file

Trend Micro Apex One Agent LPE via Exposed Dangerous Function
CVE-2023-52093 7.8 - High - January 23, 2024

An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One Agent Updater Link Follow Leads to LPE by Folder Delete
CVE-2023-52094 7.8 - High - January 23, 2024

An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arbitrary folder, leading for a local privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

insecure temporary file

Apex One Plug-In Manager Origin Validation Vulnerability Enables Local Priv Escalation
CVE-2023-47200 7.8 - High - January 23, 2024

A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2023-47201.

Origin Validation Error

Trend Micro Apex One Agent PrivEsc via Origin Validation
CVE-2023-47199 7.8 - High - January 23, 2024

An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2023-47193.

Origin Validation Error

Trend Micro Apex One: Origin Validation flaw enables local privileges escalation
CVE-2023-47197 7.8 - High - January 23, 2024

An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2023-47198.

Origin Validation Error

Privilege Escalation via Origin Validation Flaw in Trend Micro Apex One Agent
CVE-2023-47196 7.8 - High - January 23, 2024

An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2023-47197.

Origin Validation Error

CVE-2023-47195: Apex One Agent Priv Escalation via Origin Validation
CVE-2023-47195 7.8 - High - January 23, 2024

An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2023-47196.

Origin Validation Error

Trend Micro Apex One LPE via Origin Validation Vulnerability
CVE-2023-47194 7.8 - High - January 23, 2024

An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2023-47195.

Origin Validation Error

Local Priv Esc via Origin Validation in Trend Micro Apex One (CVE-2023-47193)
CVE-2023-47193 7.8 - High - January 23, 2024

An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2023-47194.

Origin Validation Error

TrendMicro ApexOne Agent Local Priv Escalation via Link Vulnerability
CVE-2023-47192 7.8 - High - January 23, 2024

An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

insecure temporary file

Trend Micro Apex One Priv Esc via Origin Validation (CVE-2023-47198)
CVE-2023-47198 7.8 - High - January 23, 2024

An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2023-47199.

Origin Validation Error

Privilege Escalation via PlugIn Manager Validation in Trend Micro Apex One
CVE-2023-47201 7.8 - High - January 23, 2024

A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to, but not identical to, CVE-2023-47200.

Local File Inclusion in Trend Micro Apex One enabling local privilege escalation
CVE-2023-47202 7.8 - High - January 23, 2024

A local file inclusion vulnerability on the Trend Micro Apex One management server could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Trend Micro Apex One local privilege escalation via agent link following
CVE-2023-52090 7.8 - High - January 23, 2024

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

insecure temporary file

Trend Micro Apex One Privilege Escalation via Anti-Spyware Link Following
CVE-2023-52091 7.8 - High - January 23, 2024

An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

insecure temporary file

Trend Micro Apex One: LPE via Link Following CVE-2023-52092
CVE-2023-52092 7.8 - High - January 23, 2024

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

insecure temporary file

Apex Central XSS Enables Remote Code Execution (CVE-2023-52330)
CVE-2023-52330 6.1 - Medium - January 23, 2024

A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Micro Apex Central. Please note: user interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

XSS

Trend Micro Apex One AV Uninstaller Module allows arbitrary command execution
CVE-2023-41179 7.2 - High - September 19, 2023

A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.

Code Injection

Privilege Escalation via Apex One Agent Registry Key Deletion
CVE-2023-30902 5.5 - Medium - June 26, 2023

A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionally delete privileged Trend Micro registry keys including its own protected registry keys on affected installations.

CVE-2023-32555: TOCTOU Privilege Escalation in Trend Micro Apex One Agent
CVE-2023-32555 7 - High - June 26, 2023

A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32554.

TOCTTOU

Trend Micro Apex One: Improper Access Control Disclosure
CVE-2023-32552 5.3 - Medium - June 26, 2023

An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents. This is similar to, but not identical to CVE-2023-32553

Trend Micro Apex One: Unauth Access Control for Sensitive Info Disclosure
CVE-2023-32553 5.3 - Medium - June 26, 2023

An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents. This is similar to, but not identical to CVE-2023-32552.

Trend Micro Apex One Priv Escalation via Exploitable Safe Write to Agent Subkeys
CVE-2023-34146 7.8 - High - June 26, 2023

An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34147 and CVE-2023-34148.

Improper Privilege Management

Trend Micro Apex One Agent: Escalation via Exposed Dangerous Function
CVE-2023-34147 7.8 - High - June 26, 2023

An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34146 and CVE-2023-34148.

Improper Privilege Management

CVE-2023-34148: Apex One Agent Privilege Escalation via Exposed Function
CVE-2023-34148 7.8 - High - June 26, 2023

An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34146 and CVE-2023-34147.

Improper Privilege Management

Trend Micro Apex One Path Traversal allows RCE via File Upload
CVE-2023-32557 9.8 - Critical - June 26, 2023

A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges.

Directory traversal

Untrusted Search Path Privilege Escalation in Trend Micro Apex One
CVE-2023-34145 7.8 - High - June 26, 2023

An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34144.

Untrusted Path

Untrusted Search Path PrivEsc in Trend Micro Apex One Agent
CVE-2023-34144 7.8 - High - June 26, 2023

An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34145.

Untrusted Path

Trend Micro Apex One link following pseudo-symlink vulnerability
CVE-2023-25148 7.8 - High - March 10, 2023

A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing a specific file into a pseudo-symlink, allowing privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

insecure temporary file