Trend Micro vulnerabilities
We track 175 vulnerabilities in Trend Micro products across 60+ products. 174 are rated high or critical, and 12 have been exploited in real attacks. The most recent was published on May 21, 2026.
Latest Trend Micro vulnerabilities
- 7.8 High severity
TrendAI Apex One: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in ord
- 7.8 High severity
TrendAI Apex One: Origin Validation Error
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45206 but exists in a different process protection communication mechanism. Please note: an
- 7.8 High severity
TrendAI Apex One: Origin Validation Error
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism. Please note: an
- 7.8 High severity
TrendAI Apex One: Origin Validation Error
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different process protection mechanism. Please note: an attacker must
- 7.8 High severity
TrendAI Apex One: Origin Validation Error
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism. Please note: an attac
- 7.8 High severity
TrendAI Apex One: Origin Validation Error
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different named pipe communication mechanism. Please note: an attacker
- 7.8 High severity
TrendAI Apex One: Origin Validation Error
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to e
- 6.7 Medium severity
Trend Micro Apex One (On-Premise) Directory Traversal Exploited
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploi
- 7.8 High severity
TrendAI Apex One (Mac): Origin Validation Error
An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-priv
- 7.8 High severity
TrendAI Apex One (Mac): Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged co
- 7.0 High severity
TrendAI Apex One (Mac): Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to exec
- 7.8 High severity
TrendAI Apex One (Mac): Origin Validation Error
An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code
- 7.8 High severity
TrendAI Apex One: Origin Validation Error
An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order
- 7.8 High severity
TrendAI Apex One: Improper Link Resolution Before File Access
A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in
- 9.8 Critical severity
TrendAI Apex One: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. P
- 9.8 Critical severity
TrendAI Apex One: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. Please note: although this vulnerability carries a technical critical CVSS rating, this was re
- 7.5 High severity
Trend Micro Apex Central: Out-of-bounds Read
A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.
- 7.5 High severity
Trend Micro Apex Central: NULL Pointer Dereference
A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.
- 9.8 Critical severity
Trend Micro Apex Central: Buffer Copy without Checking Size of Input
A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installati
- 9.8 Critical severity
Trend Micro Apex One: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but ta
- 9.8 Critical severity
Trend Micro Apex One OS Command Injection Exploited
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
- 7.8 High severity
Trend Micro Cleaner One Pro: Windows Shortcut Following (.LNK)
Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
- 9.8 Critical severity
Trend Micro Worry-Free Business Security…: Missing Authentication for Critical Functionality
A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to remotely take control of the agent on affected installations. Also note: this vulnerability only affecte
- 7.8 High severity
Trend Micro Password Manager: Improper Link Resolution Before File Access
Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportunity to abuse symbolic links and other methods to delete any file/folder and achie
- 7.1 High severity
Trend Micro Security (Consumer): Windows Shortcut Following (.LNK)
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
- 7.1 High severity
Trend Micro Internet Security (Consumer): Windows Shortcut Following (.LNK)
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
- 7.1 High severity
Trend Micro Internet Security (Consumer): Windows Shortcut Following (.LNK)
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
- 7.8 High severity
Trend Micro Endpoint Encryption Policy Server: Improper Neutralization of Special Elements used in an SQL Command
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215. Please note: an attacker must first o
- 9.8 Critical severity
Trend Micro Endpoint Encryption Policy Server: Deserialization of Untrusted Data
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method
- 9.8 Critical severity
Trend Micro Endpoint Encryption Policy Server: Use of Obsolete Function
An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations.
- 8.8 High severity
Trend Micro Endpoint Encryption Policy Server: Improper Neutralization of Special Elements used in an SQL Command
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the t
- 8.8 High severity
Trend Micro Endpoint Encryption Policy Server: Deserialization of Untrusted Data
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code
- 9.8 Critical severity
Trend Micro Endpoint Encryption Policy Server: Deserialization of Untrusted Data
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method
- 9.8 Critical severity
Trend Micro Endpoint Encryption Policy Server: Deserialization of Untrusted Data
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method
- 7.8 High severity
Trend Micro Endpoint Encryption Policy Server: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target syst
- 7.8 High severity
Trend Micro Deep Security: Improper Link Resolution Before File Access
A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-pr
- 7.8 High severity
Trend Micro Deep Security: Improper Link Resolution Before File Access
A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in
- 7.1 High severity
Trend Micro Apex Central: Server-Side Request Forgery
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations. Please note: this vulnerability only affects the SaaS in
- 7.5 High severity
Trend Micro Apex Central: Server-Side Request Forgery
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
- 7.5 High severity
Trend Micro Apex Central: Server-Side Request Forgery
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.