Vendor scorecard
CISA lists 12 Trend Micro vulnerabilities as exploited in the wild, 1 of them added in the last 12 months (flat from 1 in the 12 months before). 0 (0%) are known to be used in ransomware campaigns. For entries added in the last two years, the median time from CVE publication to the KEV listing was 6 days. Most affected: Apex One (2), Apex One and OfficeScan (2), Apex One, Apex One as a Service, and Worry-Free Business Security (2).
| Product | KEV entries |
|---|---|
| Apex One | 2 |
| Apex One and OfficeScan | 2 |
| Apex One, Apex One as a Service, and Worry-Free Business Security | 2 |
| Apex One and Worry-Free Business Security | 1 |
| Apex One and Apex One as a Service | 1 |
| Apex Central | 1 |
| OfficeScan | 1 |
| Apex One, OfficeScan and Worry-Free Business Security Agents | 1 |
| Apex One, OfficeScan, and Worry-Free Business Security | 1 |
| CVE | Vulnerability | Added |
|---|---|---|
| CVE-2026-34926 | Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityApex One | |
| CVE-2025-54948 | Trend Micro Apex One OS Command Injection VulnerabilityApex One | |
| CVE-2023-41179 | Trend Micro Apex One and Worry-Free Business Security Remote Code Execution VulnerabilityApex One and Worry-Free Business Security | |
| CVE-2022-40139 | Trend Micro Apex One and Apex One as a Service Improper Validation VulnerabilityApex One and Apex One as a Service | |
| CVE-2022-26871 | Trend Micro Apex Central Arbitrary File Upload VulnerabilityApex Central | |
| CVE-2021-36742 | Trend Micro Multiple Products Improper Input Validation VulnerabilityApex One, Apex One as a Service, and Worry-Free Business Security | |
| CVE-2021-36741 | Trend Micro Multiple Products Improper Input Validation VulnerabilityApex One, Apex One as a Service, and Worry-Free Business Security | |
| CVE-2020-8599 | Trend Micro Apex One and OfficeScan Authentication Bypass VulnerabilityApex One and OfficeScan | |
| CVE-2020-8468 | Trend Micro Multiple Products Content Validation Escape VulnerabilityApex One, OfficeScan and Worry-Free Business Security Agents | |
| CVE-2020-8467 | Trend Micro Apex One and OfficeScan Remote Code Execution VulnerabilityApex One and OfficeScan | |
| CVE-2020-24557 | Trend Micro Multiple Products Improper Access Control VulnerabilityApex One, OfficeScan, and Worry-Free Business Security | |
| CVE-2019-18187 | Trend Micro OfficeScan Directory Traversal VulnerabilityOfficeScan |
Get an email when CISA adds the next Trend Micro CVE.
How to read this: CISA KEV lists vulnerabilities with reliable evidence of exploitation; a vendor with many entries is often one with a large, internet-facing install base, not necessarily worse engineering. "Publication → KEV" is the median number of days between the CVE's publication and its addition to KEV, for entries added in the last 24 months (2 entries); it is an upper bound on how long defenders had, since exploitation usually starts before the listing. Under NIS2 article 21(2)(d), supplier security is part of your risk management; this page is a starting point for that review. Compare vendors on the scorecard index.
We assess supplier security for NIS2 and DORA, from exploited-CVE history and patch response to contract clauses and evidence packs.
Get in touch →