Trend Micro · Apex One and Apex One as a Service
CVE-2022-40139
Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability
What it is
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.
CISA: Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: October 6, 2022
- Added to the CISA list
- September 15, 2022
- Published
- September 19, 2022
- Severity
- High 7.2 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 3.4% in the top 11.1% of all known vulnerabilities
- Weakness
- CWE-353 CWE-641
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Trend Micro
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 21, 2026 | (On-Premise) Directory Traversal | Apex One | Medium 6.7 | 13% |
| Aug 18, 2025 | OS Command Injection | Apex One | Critical 9.4 | 25% |
| Sep 21, 2023 | Remote Code Execution | Apex One and Worry-Free Business Security | High 7.2 | 4.2% |
| Mar 31, 2022 | Arbitrary File Upload | Apex Central | Critical 9.8 | 19% |
| Nov 3, 2021 | Remote Code Execution | Apex One and OfficeScan | High 8.8 | 11% |
| Nov 3, 2021 | Multiple Products Content Validation Escape | Apex One, OfficeScan and Worry-Free Business Security Agents | High 8.8 | 6.2% |
| Nov 3, 2021 | Authentication Bypass | Apex One and OfficeScan | Critical 9.8 | 12% |
| Nov 3, 2021 | Directory Traversal | OfficeScan | High 8.8 | 25% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.