XML external entity injection in Trend Micro Deep Security
Priority LOW 25CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.
Summary
Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM).
Why it matters now
EPSS 0.01227 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Trend Micro | Trend Micro Deep Security | 10.x; 11.x | — | No fix listed | CNA |
| Trend Micro | Trend Micro Vulnerability Protection | 2.0 | — | No fix listed | CNA |
- Trend Micro Deep Security VendorTrend Micro Affected 10.x; 11.x Fixed in — No fix listed CNA
- Trend Micro Vulnerability Protection VendorTrend Micro Affected 2.0 Fixed in — No fix listed CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:-:*:*:*:*:*:* | 10.0 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u1:*:*:*:*:*:* | 10.0 u1 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u10:*:*:*:*:*:* | 10.0 u10 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u11:*:*:*:*:*:* | 10.0 u11 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u12:*:*:*:*:*:* | 10.0 u12 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u13:*:*:*:*:*:* | 10.0 u13 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u14:*:*:*:*:*:* | 10.0 u14 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u15:*:*:*:*:*:* | 10.0 u15 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u16:*:*:*:*:*:* | 10.0 u16 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u17:*:*:*:*:*:* | 10.0 u17 | Vulnerable | Trendmicro |
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:-:*:*:*:*:*:* Versions 10.0 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u1:*:*:*:*:*:* Versions 10.0 u1 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u10:*:*:*:*:*:* Versions 10.0 u10 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u11:*:*:*:*:*:* Versions 10.0 u11 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u12:*:*:*:*:*:* Versions 10.0 u12 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u13:*:*:*:*:*:* Versions 10.0 u13 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u14:*:*:*:*:*:* Versions 10.0 u14 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u15:*:*:*:*:*:* Versions 10.0 u15 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u16:*:*:*:*:*:* Versions 10.0 u16 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u17:*:*:*:*:*:* Versions 10.0 u17 Vulnerable ·Trendmicro
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u18:*:*:*:*:*:* | 10.0 u18 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u19:*:*:*:*:*:* | 10.0 u19 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u2:*:*:*:*:*:* | 10.0 u2 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u3:*:*:*:*:*:* | 10.0 u3 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u4:*:*:*:*:*:* | 10.0 u4 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u5:*:*:*:*:*:* | 10.0 u5 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u6:*:*:*:*:*:* | 10.0 u6 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u7:*:*:*:*:*:* | 10.0 u7 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u8:*:*:*:*:*:* | 10.0 u8 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:10.0:u9:*:*:*:*:*:* | 10.0 u9 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:11.0:-:*:*:*:*:*:* | 11.0 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:11.0:u1:*:*:*:*:*:* | 11.0 u1 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:11.0:u2:*:*:*:*:*:* | 11.0 u2 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:11.0:u3:*:*:*:*:*:* | 11.0 u3 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:11.0:u4:*:*:*:*:*:* | 11.0 u4 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:11.0:u5:*:*:*:*:*:* | 11.0 u5 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:11.0:u6:*:*:*:*:*:* | 11.0 u6 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:11.0:u7:*:*:*:*:*:* | 11.0 u7 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:deep_security_manager:11.3:-:*:*:*:*:*:* | 11.3 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:vulnerability_protection:2.0:-:*:*:*:*:*:* | 2.0 | Vulnerable | Trendmicro |
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u18:*:*:*:*:*:* Versions 10.0 u18 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u19:*:*:*:*:*:* Versions 10.0 u19 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u2:*:*:*:*:*:* Versions 10.0 u2 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u3:*:*:*:*:*:* Versions 10.0 u3 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u4:*:*:*:*:*:* Versions 10.0 u4 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u5:*:*:*:*:*:* Versions 10.0 u5 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u6:*:*:*:*:*:* Versions 10.0 u6 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u7:*:*:*:*:*:* Versions 10.0 u7 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u8:*:*:*:*:*:* Versions 10.0 u8 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:10.0:u9:*:*:*:*:*:* Versions 10.0 u9 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:11.0:-:*:*:*:*:*:* Versions 11.0 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:11.0:u1:*:*:*:*:*:* Versions 11.0 u1 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:11.0:u2:*:*:*:*:*:* Versions 11.0 u2 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:11.0:u3:*:*:*:*:*:* Versions 11.0 u3 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:11.0:u4:*:*:*:*:*:* Versions 11.0 u4 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:11.0:u5:*:*:*:*:*:* Versions 11.0 u5 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:11.0:u6:*:*:*:*:*:* Versions 11.0 u6 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:11.0:u7:*:*:*:*:*:* Versions 11.0 u7 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:deep_security_manager:11.3:-:*:*:*:*:*:* Versions 11.3 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:vulnerability_protection:2.0:-:*:*:*:*:*:* Versions 2.0 Vulnerable ·Trendmicro
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-9488
- 2026-10-03 Alias added: GHSA-8jfp-988r-jm7r
References
More Trend Micro vulnerabilities
- TI-2025-34668 OS command injection in Trend Micro Apex One KEVCVSS 3.1CRITICAL 9.8
- TI-2022-10115 Insufficient verification of data authenticity in Trend Micro Apex Central KEVCVSS 3.1CRITICAL 9.8
- TI-2020-06895 Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-14867 Unrestricted file upload in Trend Micro Apex One KEVCVSS 3.1HIGH 8.8
- TI-2020-06795 Injection in Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free… KEVCVSS 3.1HIGH 8.8
- TI-2020-06794 A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a… KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2019-9488 · CVE Program
- CVE-2019-9488 · NVD
- FIRST EPSS
- GHSA-8jfp-988r-jm7r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences