Vendor
Trend Micro: actively exploited vulnerabilities
12 vulnerabilities in Trend Micro products are listed in CISA’s catalog of actively exploited vulnerabilities. Latest addition on May 21, 2026: CVE-2026-34926 (Apex One).
- 12 exploited vulnerabilities in the catalog
- 1 added in the last 12 months
- 0 used by ransomware
- 9 products affected
Affected products
- Apex One2
- Apex One and OfficeScan2
- Apex One, Apex One as a Service, and Worry-Free Business Security2
- Apex Central1
- Apex One and Apex One as a Service1
- Apex One and Worry-Free Business Security1
- Apex One, OfficeScan and Worry-Free Business Security Agents1
- Apex One, OfficeScan, and Worry-Free Business Security1
- OfficeScan1
All exploited vulnerabilities
CISA KEV catalog, newest first: each entry corresponds to observed exploitation.
2026 1 vulnerability
-
CVE-2026-34926Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
2025 1 vulnerability
-
CVE-2025-54948Trend Micro Apex One OS Command Injection Vulnerability
2023 1 vulnerability
-
CVE-2023-41179Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability
2022 2 vulnerabilities
-
CVE-2022-40139Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability
-
CVE-2022-26871Trend Micro Apex Central Arbitrary File Upload Vulnerability
2021 7 vulnerabilities
-
CVE-2021-36742Trend Micro Multiple Products Improper Input Validation Vulnerability
-
CVE-2021-36741Trend Micro Multiple Products Improper Input Validation Vulnerability
-
CVE-2020-8599Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
-
CVE-2020-8468Trend Micro Multiple Products Content Validation Escape Vulnerability
-
CVE-2020-8467Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
-
CVE-2020-24557Trend Micro Multiple Products Improper Access Control Vulnerability
-
CVE-2019-18187Trend Micro OfficeScan Directory Traversal Vulnerability
What to do
If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.
Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.