CVE-2023-41179

CVE-2023-41179 affects Trend Micro Apex One (on‑prem and SaaS) and Worry‑Free Business Security products, via a vulnerability in the third‑party AV uninstaller module that could allow arbitrary code execution. An attacker must have administrative console access to exploit the issue, and the vulne...

CVE-2022-24678

CVE-2022-24678 affects Trend Micro Apex One and related agents (Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Services). The vulnerability is a denial-of-service caused by resource exhaustion in the agent’s logging path: an attacker can flood a temporary log location by issuing...

CVE-2022-24680

CVE-2022-24680 affects Trend Micro Apex One family (Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and related service agents). The root cause is a local privilege escalation in the NT Apex One RealTime Scan Service where an attacker can create a mount point, enabling arbi...

CVE-2022-24679

CVE-2022-24679 concerns Trend Micro Apex One and related products (Apex One as a Service, WSB/Security Services agents). The vulnerability exists in the NT Apex One RealTime Scan Service: by abusing a DOS device redirection, a local attacker can create a writable folder in an arbitrary location a...

CVE-2020-24556

Summary (CVE-2020-24556 family) : Affected Trend Micro products running on Windows (Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1/Services). The core issue is a privilege-escalation/vector via creating a hard link to arbitrary files, enabling code execution after an attacker ga...

CVE-2022-36336

CVE-2022-36336 involves a local privilege-escalation in Trend Micro Apex One and Worry-Free Business Security agents caused by a link-following vulnerability in the scanning function. The available details identify the vulnerable component as the scanning service path in these products (notably t...

CVE-2016-1223

CVE-2016-1223 affects Trend Micro OfficeScan 11.0 and Worry-Free Business Security variants (Security Services 5.x and 9.0). The OpenVAS entries describe a directory traversal vulnerability in Trend Micro products that can allow remote attackers with LAN access to read arbitrary files through uns...

CVE-2021-45441

Trend Micro Apex One contains a local privilege escalation flaw in the Apex One NT RealTime Scan service caused by insufficient validation of the origin of commands. The vulnerability allows a local attacker who can run low-privilege code to drop and manipulate a crafted file to issue commands th...

CVE-2020-24559

CVE-2020-24559 affects Trend Micro Apex One, Worry-Free Business Security (macOS). A local privilege escalation allows an attacker who can run low-privileged code to manipulate a binary so it loads and executes a script from a user-writable folder, enabling arbitrary code execution as root. Publi...

CVE-2021-45231

CVE-2021-45231 is a local privilege escalation affecting Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10.0 SP1 and Services). The issue arises in the Real-time Scan Service: an attacker who can run low-privilege code can abuse a symbolic link to overwrite ...

CVE-2021-45442

Technical details for CVE-2021-45442 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

CVE-2016-1224

CVE-2016-1224 involves an HTTP header injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0. Connected sources confirm that this vulnerability allows injection of HTTP headers and may enable cross-site scripting under certain conditio...

CVE-2020-24558

Trend Micro Apex One and related products (Worry-Free Business Security dll) are affected by CVE-2020-24558. The root cause is an out-of-bounds read in OfcPIPC_64x.dll caused by insufficient validation of user-supplied data, enabling a local, low-privilege attacker to trigger an out-of-bounds rea...

CVE-2021-23139

The CVE-2021-23139 issue affects Trend Micro Apex One and Worry-Free Business Security 10.0 SP1. A null pointer dereference in the CGI interface can allow a remote attacker to crash the CGI process, resulting in a denial of service. Descriptions and connected documents confirm the vulnerability i...

CVE-2021-42108

CVE-2021-42108 affects Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 via the Web Console. The root cause is an untrusted process impersonating the client of a pipe, enabling a local attacker with low-privilege code execution to escalate to SYSTEM-level priv...

CVE-2021-42105

CVE-2021-42105 describes a local privilege escalation in Trend Micro products (Apex One, Apex One as a Service, Worry‑Free Business Security 10.0 SP1 and Worry‑Free Business Security Services). The vulnerability allows a local attacker who already can execute low‑privileged code to escalate privi...

CVE-2021-42104

Technical details about CVE-2021-42104 are not publicly provided in the supplied connected documents. No product/version/impact specifics are confirmed here. Monitor for updates.

CVE-2021-42106

CVE-2021-42106 affects Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services. The issue is described as an unnecessary privilege vulnerability that could allow a local attacker to escalate privileges on affected installations...

CVE-2021-42012

CVE-2021-42012 affects Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security 10.0 SP1. The vulnerability is a stack-based buffer overflow in the Trend Micro Security Server Database Service that allows a local attacker to escalate to SYSTEM privileges. Successful exploitat...

CVE-2021-45440

CVE-2021-45440 affects Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on‑prem). The issue is an unrelated privilege escalation via an impersonation vulnerability in the Security Server pipeline, allowing a local attacker who can run low‑privileged code to escalate to ...

CVE-2021-42107

CVE-2021-42107 describes a local privilege escalation in Trend Micro products: Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services. The issue is an “unnecessary privilege” vulnerability that would allow a local attacker to escalate pri...

CVE-2021-44024

CVE-2021-44024 affects Trend Micro Apex One (on‑prem and SaaS) and Trend Micro Worry‑Free Business Security (10.0 SP1/Services). The issue is a denial‑of‑service flaw exploitable via symbolic link abuse in the Real‑time Scan Service, allowing a local attacker who already has low‑privilege code ex...

CVE-2025-49487

Trend Micro Worry-Free Business Security Services (WFBSS) SaaS client is vulnerable to an uncontrolled search path/element that could allow an attacker with physical access to execute arbitrary code (in ZDI, as SYSTEM). The on-premise WFBSS is not affected. Root cause is tied to loading an OpenSS...

CVE-2025-53378

CVE-2025-53378 concerns Trend Micro Worry-Free Business Security Services (WFBSS) agent. The issue is a missing authentication vulnerability that could allow an unauthenticated attacker to remotely take control of the agent on affected installations. Affected product scope is limited to the SaaS ...

CVE-2025-49154

CVE-2025-49154 affects Trend Micro Apex One and Trend Micro Worry-Free Business Security with an insecure access control vulnerability that can allow a local attacker to overwrite key memory-mapped files, impacting security and stability. Root cause is improper access controls; exploitation requi...