Code injection in Trend Micro Apex One
Priority CRITICAL 91Exploited in the wildCWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.
Summary
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Why it matters now
Exploitation Active In CISA KEV since 2023-09-21CISA due date 2023-10-12
EPSS 0.04216 91st percentileScored 2026-11-07
Fix Fixed Trend Micro Apex One (Trend Micro, Inc.): 14.0.0.12380, 14.0.12637Trend Micro Worry-Free Business Security (Trend Micro, Inc.): 10.0 SP1 Build 2495+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Trend Micro | Trend Micro Apex One | 2019 (14.0) to before 14.0.0.12380 | 14.0.0.12380 | Patch available | CNA |
| Trend Micro | Trend Micro Apex One | SaaS to before 14.0.12637 | 14.0.12637 | Patch available | CNA |
| Trend Micro | Trend Micro Worry-Free Business Security | 10.0 SP1 to before 10.0 SP1 Build 2495 | 10.0 SP1 Build 2495 | Patch available | CNA |
| Trend Micro | Trend Micro Worry-Free Business Security Services | SaaS to before 6.7.3578 / 14.3.1105 | 6.7.3578 / 14.3.1105 | Patch available | CNA |
- Trend Micro Apex One VendorTrend Micro Affected 2019 (14.0) to before 14.0.0.12380 Fixed in 14.0.0.12380 Patch available CNA
- Trend Micro Apex One VendorTrend Micro Affected SaaS to before 14.0.12637 Fixed in 14.0.12637 Patch available CNA
- Trend Micro Worry-Free Business Security VendorTrend Micro Affected 10.0 SP1 to before 10.0 SP1 Build 2495 Fixed in 10.0 SP1 Build 2495 Patch available CNA
- Trend Micro Worry-Free Business Security Services VendorTrend Micro Affected SaaS to before 6.7.3578 / 14.3.1105 Fixed in 6.7.3578 / 14.3.1105 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:-:*:*:* | 2019 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:saas:*:*:* | 2019 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:* | 10.0 sp1 | Vulnerable | Trendmicro |
| cpe:2.3:a:trendmicro:worry-free_business_security_services:-:*:*:*:saas:*:*:* | not specified by NVD | Vulnerable | Trendmicro |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:-:*:*:* Versions 2019 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:saas:*:*:* Versions 2019 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:* Versions 10.0 sp1 Vulnerable ·Trendmicro
- cpe:2.3:a:trendmicro:worry-free_business_security_services:-:*:*:*:saas:*:*:* Versions not specified by NVD Vulnerable ·Trendmicro
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Trend Micro Apex One (Trend Micro, Inc.) Fixed in 14.0.0.12380
- Fix · CNA Trend Micro Apex One (Trend Micro, Inc.) Fixed in 14.0.12637
- Fix · CNA Trend Micro Worry-Free Business Security (Trend Micro, Inc.) Fixed in 10.0 SP1 Build 2495
- Fix · CNA Trend Micro Worry-Free Business Security Services (Trend Micro, Inc.) Fixed in 6.7.3578 / 14.3.1105
Timeline
- 2023-09-21 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2023-41179
- 2026-10-03 Alias added: GHSA-vq2c-8m6j-g4vh
References
More Trend Micro vulnerabilities
- TI-2025-34668 OS command injection in Trend Micro Apex One KEVCVSS 3.1CRITICAL 9.8
- TI-2022-10115 Insufficient verification of data authenticity in Trend Micro Apex Central KEVCVSS 3.1CRITICAL 9.8
- TI-2020-06895 Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-14867 Unrestricted file upload in Trend Micro Apex One KEVCVSS 3.1HIGH 8.8
- TI-2020-06795 Injection in Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free… KEVCVSS 3.1HIGH 8.8
- TI-2020-06794 A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a… KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2023-41179 · CVE Program
- CVE-2023-41179 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-vq2c-8m6j-g4vh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences