Trendmicro Apex Central vulnerabilities
35 vulnerabilities
Known vulnerabilities in Trendmicro Apex Central, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-25252trend microtrend micro virus scan api (vsapi) engine+19
EPSS score0.62%
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.CVE-2025-47866trend micro, inc.trend micro apex central+1EPSS score0.30%
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.CVE-2025-47867trend micro, inc.trend micro apex central+1EPSS score1.90%
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations.CVE-2025-47865trend micro, inc.trend micro apex central+1EPSS score1.80%
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.CVE-2025-69258trend micro, inc.trend micro apex central+1EPSS score3.57%
A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations.CVE-2025-69260trend micro, inc.trend micro apex central+1EPSS score1.58%
A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations.
Please note: authentication is not required in order to exploit this vulnerability.CVE-2025-69259trend micro, inc.trend micro apex central+1EPSS score1.58%
A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations.
Please note: authentication is not required in order to exploit this vulnerability..CVE-2025-49220trend micro, inc.trend micro apex central+1EPSS score2.06%
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.CVE-2025-49219trend micro, inc.trend micro apex central+1EPSS score1.42%
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.CVE-2025-30680trend micro, inc.trend micro apex central+1EPSS score0.30%
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
Please note: this vulnerability only affects the SaaS instance of Apex Central - customers that automatically apply Trend Micro's monthly maintenance releases to the SaaS instance do not have to take any further action.CVE-2025-30679trend micro, inc.trend micro apex central+1EPSS score0.36%
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.CVE-2025-30678trend micro, inc.trend micro apex central+1EPSS score0.36%
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.CVE-2022-26871trend microtrend micro apex central+2KEVEPSS score19.48%
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.CVE-2023-52324trend micro, inc.trend micro apex central+1EPSS score4.14%
An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations.
Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any valid set of credentials. Also, this vulnerability could be potentially used in combination with another vulnerability to execute arbitrary code.CVE-2023-52326trend micro, inc.trend micro apex central+1EPSS score2.45%
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
Please note this vulnerability is similar, but not identical to CVE-2023-52327.CVE-2023-52331trend micro, inc.trend micro apex central+1EPSS score0.55%
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local services directly.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.CVE-2023-52328trend micro, inc.trend micro apex central+1EPSS score2.45%
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
Please note this vulnerability is similar, but not identical to CVE-2023-52329.CVE-2023-52325trend micro, inc.trend micro apex central+1EPSS score4.54%
A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations.
Please note: this vulnerability must be used in conjunction with another one to exploit an affected system. In addition, an attacker must first obtain a valid set of credentials on target system in order to exploit this vulnerability.CVE-2023-52327trend micro, inc.trend micro apex central+1EPSS score2.45%
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
Please note this vulnerability is similar, but not identical to CVE-2023-52328.CVE-2023-52329trend micro, inc.trend micro apex central+1EPSS score0.94%
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.
Please note this vulnerability is similar, but not identical to CVE-2023-52326.