Actively exploited in the wild
Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability
Trend Micro - Apex One and Worry-Free Business Security · Listed in the CISA KEV since 2023-09-21. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-41179
HighCVSS 7.2KEVSummary
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Risk Assessment
An attacker with administrative console access could execute arbitrary commands on the system, leading to full compromise. High risk for organizations using these products.
Recommendation
Immediately apply available updates for Trend Micro Apex One, Worry-Free Business Security, and Worry-Free Business Security Services. Restrict administrative console access to trusted networks.
Other vulnerabilities in Trend Micro Apex One
See all- CVE-2026-34926MediumActively exploited
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents. The attack requires access to the server and prior administrative credentials.
- CVE-2025-71211Critical
A vulnerability in the Trend Micro Apex One management console (similar to CVE-2025-71210 but affecting a different executable) allows a remote attacker to upload malicious code and execute commands. Requires access to the management console. SaaS versions are already patched.
- CVE-2025-71210Critical
A vulnerability in the Trend Micro Apex One management console allows a remote attacker to upload malicious code and execute commands. Requires access to the management console. SaaS versions are already patched.
- CVE-2025-54948CriticalActively exploited
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
- CVE-2022-40139HighActively exploited
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow an Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. An attacker must first obtain Apex One server administration console access to exploit this vulnerability.
- CVE-2021-36742HighActively exploited
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system.
- CVE-2021-36741HighActively exploited
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attacker to upload arbitrary files on affected installations. An attacker must first obtain the ability to logon to the product's management console.
- CVE-2020-8599CriticalActively exploited
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
- CVE-2020-8468HighActively exploited
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.
- CVE-2020-8467HighActively exploited
A migration tool component in Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability that could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.
Original NVD description (English source)
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.