Trend Micro vulnerabilities
We track 175 vulnerabilities in Trend Micro products across 60+ products. 174 are rated high or critical, and 12 have been exploited in real attacks. The most recent was published on May 21, 2026.
Latest Trend Micro vulnerabilities
- 7.8 High severity
Trend Micro Apex One: Uncontrolled Search Path Element
An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the t
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the targe
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system i
- 8.8 High severity
Trend Micro Apex One: Uncontrolled Search Path Element
An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.
- 7.8 High severity
Trend Micro Apex One: Improper Access Control
An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected
- 9.8 Critical severity
Trend Micro Apex Central: Deserialization of Untrusted Data
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
- 9.8 Critical severity
Trend Micro Apex Central: Deserialization of Untrusted Data
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method
- 9.8 Critical severity
Trend Micro Apex Central: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations.
- 7.5 High severity
Trend Micro Apex Central: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
- 9.8 Critical severity
Trend Micro Apex Central: Undefined Behavior for Input to API
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.
- 9.0 Critical severity
Trend Vision One: Improper Neutralization of Input During Web Page Generation
An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. Please note: this issue has already been addressed on the backend service and is no longer considered an active vulnerabili
- 7.2 High severity
Trend Vision One: Improper Privilege Management
A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue
- 7.2 High severity
Trend Vision One: Improper Privilege Management
A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue ha
- 7.2 High severity
Trend Vision One: Improper Privilege Management
A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issu
- 7.2 High severity
Trend Vision One: Improper Privilege Management
A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths is
- 7.8 High severity
Trend Micro Apex One: Incorrect User Management
A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. This CVE address an addtional bypass not covered in CVE-202
- 7.8 High severity
Trend Micro Apex One: Improper Privilege Management
A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to e
- 7.8 High severity
Trend Micro HouseCall for Home Networks: Uncontrolled Search Path Element
Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker with low user privileges to create a malicious DLL that could lead to escalated privileges.
- 7.3 High severity
Trend Micro Deep Security: Incorrect Permission Assignment for Critical Resource
An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain t
- 7.8 High severity
Trend Micro Apex One: Origin Validation Error
An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order
- 7.8 High severity
Trend Micro Apex One: Improper Privilege Management
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in o
- 7.8 High severity
Trend Micro Apex One: Improper Privilege Management
An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to
- 8.2 High severity
Trend Micro ID Security: Allocation of Resources Without Limits or Throttling
Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests without any restriction, potentially leading to abuse or denial of service.
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A LogServer arbitrary file creation vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system
- 7.8 High severity
Trend Micro Apex One: Incorrect Privilege Assignment
A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerability is similar to, but not identical to CVE-2024-52048. Please note: an attacker must first obtain th
- 7.8 High severity
Trend Micro Apex One: Incorrect Privilege Assignment
A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerability is similar to, but not identical to CVE-2024-52049. Please note: an attacker must first obtain th
- 8.8 High severity
Trend Micro Apex One: Files or Directories Accessible to External Parties
A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in
- 8.8 High severity
Trend Micro Deep Security: Improper Neutralization of Special Elements used in a Command
A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine. In certain circumstances, attackers that have legitimate ac
- 9.8 Critical severity
Trend Micro Cloud Edge: Improper Neutralization of Special Elements used in a Command
An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: authentication is not required in order to exploit this vulnerability.
- 7.8 High severity
Trend Micro Deep Security Agent: Improper Privilege Management
An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target sy
- 9.1 Critical severity
Trend Micro Deep Discovery Inspector: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive information affected installations. Please note: an attacker must first obtain the ability to execute high-privileged code (admin
- 7.8 High severity
Trend Micro Antivirus One: Improper Access Control
Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthorized access to product configurations and functions.
- 7.8 High severity
Trend Micro VPN (consumer): External Control of File Name or Path
Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges.
- 7.5 High severity
Trend Micro Apex One: Improper Neutralization of Special Elements used in an SQL Command
An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in orde
- 7.8 High severity
Trend Micro Apex One: Improper Access Control
An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order
- 7.8 High severity
Trend Micro Deep Security Agent: Insufficient Use of Symbolic Constants
A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in o
- 7.0 High severity
Trend Micro Apex One: Time-of-check Time-of-use (TOCTOU) Race Condition
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privilege
- 7.8 High severity
Trend Micro Apex One: Origin Validation Error
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target sys
- 7.8 High severity
Trend Micro Apex One: Origin Validation Error
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target sys