Actively exploited in the wild
Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability
Trend Micro - Apex One and Apex One as a Service · Listed in the CISA KEV since 2022-09-15. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-40139
HighCVSS 7.2KEVSummary
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow an Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. An attacker must first obtain Apex One server administration console access to exploit this vulnerability.
Risk Assessment
An Apex One server administrator could exploit this vulnerability to achieve remote code execution on clients. However, this requires prior access to the administration console.
Recommendation
Update Trend Micro Apex One to the latest version containing the fix. Restrict access to the administration console and monitor for unusual activities.
Other vulnerabilities in Trend Micro Apex One
See all- CVE-2026-34926MediumActively exploited
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents. The attack requires access to the server and prior administrative credentials.
- CVE-2025-71211Critical
A vulnerability in the Trend Micro Apex One management console (similar to CVE-2025-71210 but affecting a different executable) allows a remote attacker to upload malicious code and execute commands. Requires access to the management console. SaaS versions are already patched.
- CVE-2025-71210Critical
A vulnerability in the Trend Micro Apex One management console allows a remote attacker to upload malicious code and execute commands. Requires access to the management console. SaaS versions are already patched.
- CVE-2025-54948CriticalActively exploited
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
- CVE-2023-41179HighActively exploited
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
- CVE-2021-36742HighActively exploited
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system.
- CVE-2021-36741HighActively exploited
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attacker to upload arbitrary files on affected installations. An attacker must first obtain the ability to logon to the product's management console.
- CVE-2020-8599CriticalActively exploited
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
- CVE-2020-8468HighActively exploited
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.
- CVE-2020-8467HighActively exploited
A migration tool component in Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability that could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.
Original NVD description (English source)
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.