[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsdTYunfOA0VETipYpZFaEFaXuYlqgn3JUNgbHP4PqB0":3,"g5a-family:trendmicro\u002Fapex_one":173,"g5a-ex:trendmicro\u002Fapex_one@*":177},{"success":4,"data":5},true,{"product":6,"versions":34,"topVulnerabilitiesByEpss":42,"kevVulnerabilities":96,"seoMetadata":151,"meta":170},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":33},"trendmicro","apex_one",7,154,10,"2025-08-05",[14,18,20,22,24,26,30],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"14.0.10349",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"14.0.11789",{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},"14.0.11960",{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},"14.0.12105",{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},"14.0.12518",{"version":27,"cve_count":28,"kev_count":29,"has_kev":4},"2019",137,9,{"version":31,"cve_count":32,"kev_count":16,"has_kev":17},"saas",12,"Apex One by Trendmicro is a technology product with 7 tracked versions and 154 known security vulnerabilities including 10 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[35,36,37,38,39,40,41],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},{"version":27,"cve_count":28,"kev_count":29,"has_kev":4},{"version":31,"cve_count":32,"kev_count":16,"has_kev":17},[43,51,56,62,67,71,77,81,86,92],{"cveId":44,"description":45,"publishedDate":46,"cvssScore":47,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":50},"CVE-2023-0587","A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL \u002Fofficescan\u002Fconsole\u002Fhtml\u002Fcgi\u002FfcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e., \\PCCSRV\\TEMP\\SampleSubmission) on the server. The attacker can upload a large number of large files to fill up the file system on which the Apex One server is installed.","2023-02-01",9.1,"v3.1","Critical",0.59585,{"cveId":52,"description":53,"publishedDate":12,"cvssScore":54,"cvssVersion":48,"severity":49,"isKev":4,"epssScore":55},"CVE-2025-54948","A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.",9.4,0.23919,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":60,"cvssVersion":48,"severity":49,"isKev":4,"epssScore":61},"CVE-2022-26871","An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.","2022-03-29",9.8,0.19481,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":60,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":66},"CVE-2020-8598","Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow a remote attacker to execute arbitrary code on affected installations with SYSTEM level privileges. Authentication is not required to exploit this vulnerability.","2020-03-18",0.1324,{"cveId":68,"description":69,"publishedDate":65,"cvssScore":60,"cvssVersion":48,"severity":49,"isKev":4,"epssScore":70},"CVE-2020-8599","Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.",0.11858,{"cveId":72,"description":73,"publishedDate":65,"cvssScore":74,"cvssVersion":48,"severity":75,"isKev":4,"epssScore":76},"CVE-2020-8467","A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.",8.8,"High",0.109,{"cveId":78,"description":79,"publishedDate":65,"cvssScore":74,"cvssVersion":48,"severity":75,"isKev":4,"epssScore":80},"CVE-2020-8468","Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.",0.06165,{"cveId":82,"description":83,"publishedDate":84,"cvssScore":74,"cvssVersion":48,"severity":75,"isKev":4,"epssScore":85},"CVE-2021-36741","An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.","2021-07-29",0.04951,{"cveId":87,"description":88,"publishedDate":89,"cvssScore":90,"cvssVersion":48,"severity":75,"isKev":17,"epssScore":91},"CVE-2019-18188","Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to the IUSR account, which has restricted permission and is unable to make major system changes. An attempted attack requires user authentication.","2019-10-28",7.5,0.04661,{"cveId":93,"description":94,"publishedDate":65,"cvssScore":90,"cvssVersion":48,"severity":75,"isKev":17,"epssScore":95},"CVE-2020-8470","Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow an attacker to delete any file on the server with SYSTEM level privileges. Authentication is not required to exploit this vulnerability.",0.04584,[97,102,112,121,125,129,137,142,145,148],{"cveId":52,"description":53,"publishedDate":12,"cvssScore":54,"severity":49,"isKev":4,"epssScore":55,"cisaVulnName":98,"cisaDateAdded":99,"cisaShortDescription":100,"cisaRequiredAction":101},"Trend Micro Apex One OS Command Injection Vulnerability","2025-08-18","Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":103,"description":104,"publishedDate":105,"cvssScore":106,"severity":75,"isKev":4,"epssScore":107,"cisaVulnName":108,"cisaDateAdded":109,"cisaShortDescription":110,"cisaRequiredAction":111},"CVE-2023-41179","A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation.\r\n\r\nNote that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.","2023-09-19",7.2,0.04251,"Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability","2023-09-21","Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":113,"description":114,"publishedDate":115,"cvssScore":106,"severity":75,"isKev":4,"epssScore":116,"cisaVulnName":117,"cisaDateAdded":118,"cisaShortDescription":119,"cisaRequiredAction":120},"CVE-2022-40139","Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.","2022-09-19",0.03291,"Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability","2022-09-15","Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.","Apply updates per vendor instructions.",{"cveId":57,"description":58,"publishedDate":59,"cvssScore":60,"severity":49,"isKev":4,"epssScore":61,"cisaVulnName":122,"cisaDateAdded":123,"cisaShortDescription":124,"cisaRequiredAction":120},"Trend Micro Apex Central Arbitrary File Upload Vulnerability","2022-03-31","An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.",{"cveId":82,"description":83,"publishedDate":84,"cvssScore":74,"severity":75,"isKev":4,"epssScore":85,"cisaVulnName":126,"cisaDateAdded":127,"cisaShortDescription":128,"cisaRequiredAction":120},"Trend Micro Multiple Products Improper Input Validation Vulnerability","2021-11-03","Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.",{"cveId":130,"description":131,"publishedDate":132,"cvssScore":133,"severity":75,"isKev":4,"epssScore":134,"cisaVulnName":135,"cisaDateAdded":127,"cisaShortDescription":136,"cisaRequiredAction":120},"CVE-2020-24557","A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.","2020-09-01",7.8,0.02666,"Trend Micro Multiple Products Improper Access Control Vulnerability","Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.",{"cveId":138,"description":139,"publishedDate":84,"cvssScore":133,"severity":75,"isKev":4,"epssScore":140,"cisaVulnName":126,"cisaDateAdded":127,"cisaShortDescription":141,"cisaRequiredAction":120},"CVE-2021-36742","A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",0.01482,"Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.",{"cveId":72,"description":73,"publishedDate":65,"cvssScore":74,"severity":75,"isKev":4,"epssScore":76,"cisaVulnName":143,"cisaDateAdded":127,"cisaShortDescription":144,"cisaRequiredAction":120},"Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability","Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.",{"cveId":78,"description":79,"publishedDate":65,"cvssScore":74,"severity":75,"isKev":4,"epssScore":80,"cisaVulnName":146,"cisaDateAdded":127,"cisaShortDescription":147,"cisaRequiredAction":120},"Trend Micro Multiple Products Content Validation Escape Vulnerability","Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.",{"cveId":68,"description":69,"publishedDate":65,"cvssScore":60,"severity":49,"isKev":4,"epssScore":70,"cisaVulnName":149,"cisaDateAdded":127,"cisaShortDescription":150,"cisaRequiredAction":120},"Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability","Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.",{"title":152,"metaDescription":153,"keywords":154,"structuredData":155},"Apex One by Trendmicro - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Apex One by Trendmicro covering 7 versions with 154 tracked vulnerabilities including 3 critical and 7 high-severity issues and 10 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Apex One vulnerabilities, Apex One security, Apex One CVE, Trendmicro Apex One, Apex One threat intelligence, Trendmicro security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Apex One KEV, Apex One exploited vulnerabilities",{"@context":156,"@type":157,"name":158,"description":153,"url":159,"manufacturer":160,"applicationCategory":164,"softwareVersion":165,"mainEntity":166},"https:\u002F\u002Fschema.org","SoftwareApplication","Apex One","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Ftrendmicro\u002Fapex_one",{"@type":161,"name":162,"url":163},"Organization","Trendmicro","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Ftrendmicro","Security Software","7 versions tracked",{"@type":167,"name":168,"description":169,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Apex One Security Vulnerabilities","Security vulnerabilities affecting Apex One by Trendmicro",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":171,"apiVersion":172},"2026-10-18T00:50:08.377Z","3.0",[174],{"product":175,"cves":176},"apex_one_as_a_service",1,{"rows":178,"total":11,"capped":17,"failed":16},[179,183,187,191,195,199,203,207,211,215],{"cveId":52,"name":98,"severity":49,"cvss":54,"added":99,"epss":55,"published":180,"ranges":181,"checked":4,"hits":182,"covers":17},"2025-08-05T13:15:28.487",[27],[],{"cveId":103,"name":108,"severity":75,"cvss":106,"added":109,"epss":107,"published":184,"ranges":185,"checked":4,"hits":186,"covers":17},"2023-09-19T14:15:21.343",[27],[],{"cveId":113,"name":117,"severity":75,"cvss":106,"added":118,"epss":116,"published":188,"ranges":189,"checked":4,"hits":190,"covers":17},"2022-09-19T18:15:09.96",[27],[],{"cveId":57,"name":122,"severity":49,"cvss":60,"added":123,"epss":61,"published":192,"ranges":193,"checked":4,"hits":194,"covers":17},"2022-03-29T21:15:07.76",[],[],{"cveId":82,"name":126,"severity":75,"cvss":74,"added":127,"epss":85,"published":196,"ranges":197,"checked":4,"hits":198,"covers":17},"2021-07-29T20:15:07.62",[27],[],{"cveId":130,"name":135,"severity":75,"cvss":133,"added":127,"epss":134,"published":200,"ranges":201,"checked":4,"hits":202,"covers":17},"2020-09-01T19:15:11.87",[27],[],{"cveId":138,"name":126,"severity":75,"cvss":133,"added":127,"epss":140,"published":204,"ranges":205,"checked":4,"hits":206,"covers":17},"2021-07-29T20:15:07.65",[27],[],{"cveId":72,"name":143,"severity":75,"cvss":74,"added":127,"epss":76,"published":208,"ranges":209,"checked":4,"hits":210,"covers":17},"2020-03-18T01:15:11.927",[27],[],{"cveId":78,"name":146,"severity":75,"cvss":74,"added":127,"epss":80,"published":212,"ranges":213,"checked":4,"hits":214,"covers":17},"2020-03-18T01:15:12.003",[27],[],{"cveId":68,"name":149,"severity":49,"cvss":60,"added":127,"epss":70,"published":216,"ranges":217,"checked":4,"hits":218,"covers":17},"2020-03-18T01:15:12.223",[27],[]]