Vendor

Trend Micro

As of , 12 Trend Micro vulnerabilities are on CISA's list of exploited vulnerabilities; 1 was added in 2026. Patch first: CVE-2025-54948.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2025-54948OS Command InjectionTrend Micro Apex OnePatch soon0.24
2CVE-2022-26871Arbitrary File UploadTrend Micro Apex CentralPatch soon0.19
3CVE-2019-18187Directory TraversalTrend Micro OfficeScanPatch soon0.25
4CVE-2020-8467Remote Code ExecutionTrend Micro Apex One and OfficeScanPatch soon0.11
5CVE-2020-8599Authentication BypassTrend Micro Apex One and OfficeScanPatch soon0.12
6CVE-2020-8468Multiple Products Content Validation EscapeTrend Micro Apex One, OfficeScan and Worry-Free Business Security AgentsPatch soon0.06
7CVE-2021-36741Multiple Products Improper Input ValidationTrend Micro Apex One, Apex One as a Service, and Worry-Free Business SecurityPatch soon0.05
8CVE-2023-41179Remote Code ExecutionTrend Micro Apex One and Worry-Free Business SecurityPatch soon0.04
9CVE-2022-40139Improper ValidationTrend Micro Apex One and Apex One as a ServicePatch soon0.03
10CVE-2020-24557Multiple Products Improper Access ControlTrend Micro Apex One, OfficeScan, and Worry-Free Business SecurityPatch soon0.03
11CVE-2021-36742Multiple Products Improper Input ValidationTrend Micro Apex One, Apex One as a Service, and Worry-Free Business SecurityPatch soon0.01
12CVE-2026-34926(On-Premise) Directory TraversalTrend Micro Apex OnePatch soon0.01

Products

  • Apex One2 entries
  • Apex One and OfficeScan2 entries
  • Apex One, Apex One as a Service, and Worry-Free Business Security2 entries
  • Apex Central1 entry
  • Apex One and Apex One as a Service1 entry
  • Apex One and Worry-Free Business Security1 entry
  • Apex One, OfficeScan and Worry-Free Business Security Agents1 entry
  • Apex One, OfficeScan, and Worry-Free Business Security1 entry
  • OfficeScan1 entry

Added each year

24682021: 7720212022: 2220222023: 1120232024: nonenone20242025: 1120252026: 112026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20217
20222
20231
2024none
20251
20261

Used in ransomware