Trend Micro · OfficeScan
CVE-2019-18187
Trend Micro OfficeScan Directory Traversal Vulnerability
What it is
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.
CISA: Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- October 28, 2019
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 25% in the top 2.1% of all known vulnerabilities
- Weakness
- CWE-22
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Trend Micro
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 21, 2026 | (On-Premise) Directory Traversal | Apex One | Medium 6.7 | 13% |
| Aug 18, 2025 | OS Command Injection | Apex One | Critical 9.4 | 25% |
| Sep 21, 2023 | Remote Code Execution | Apex One and Worry-Free Business Security | High 7.2 | 4.2% |
| Sep 15, 2022 | Improper Validation | Apex One and Apex One as a Service | High 7.2 | 3.4% |
| Mar 31, 2022 | Arbitrary File Upload | Apex Central | Critical 9.8 | 19% |
| Nov 3, 2021 | Remote Code Execution | Apex One and OfficeScan | High 8.8 | 11% |
| Nov 3, 2021 | Multiple Products Content Validation Escape | Apex One, OfficeScan and Worry-Free Business Security Agents | High 8.8 | 6.2% |
| Nov 3, 2021 | Authentication Bypass | Apex One and OfficeScan | Critical 9.8 | 12% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.