Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Security vendor · EDR and XDR · in CISA KEV

Trend Micro in the CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog lists 12 entries for Trend Micro as of catalog version 2026.11.06, released November 6, 2026. The newest was added May 21, 2026, and the latest federal due date is June 4, 2026.

Updated

entries in the catalog
12
newest addition
May 21, 2026
latest federal due date
June 4, 2026
marked known ransomware use
0

Directory record

Website
www.trendmicro.com
Categories
EDR and XDR (primary), Cloud-native application protection (CNAPP), Email security
Headquarters
Tokyo, Japan
Founded
1988
Ownership
Public (TSE: 4704)
Company record
Trend Micro on CISO Tribune

Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.

KEV entries, newest first

Filed by CISA under the name “Trend Micro”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

  1. Added May 21, 2026

    CVE-2026-34926 Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

    Apex One

    Due June 4, 2026

  2. Added August 18, 2025

    CVE-2025-54948 Trend Micro Apex One OS Command Injection Vulnerability

    Apex One

    Due September 8, 2025

  3. Added September 21, 2023

    CVE-2023-41179 Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability

    Apex One and Worry-Free Business Security

    Due October 12, 2023

  4. Added September 15, 2022

    CVE-2022-40139 Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability

    Apex One and Apex One as a Service

    Due October 6, 2022

  5. Added March 31, 2022

    CVE-2022-26871 Trend Micro Apex Central Arbitrary File Upload Vulnerability

    Apex Central

    Due April 21, 2022

  6. Added November 3, 2021

    CVE-2021-36742 Trend Micro Multiple Products Improper Input Validation Vulnerability

    Apex One, Apex One as a Service, and Worry-Free Business Security

    Due November 17, 2021

  7. Added November 3, 2021

    CVE-2021-36741 Trend Micro Multiple Products Improper Input Validation Vulnerability

    Apex One, Apex One as a Service, and Worry-Free Business Security

    Due November 17, 2021

  8. Added November 3, 2021

    CVE-2020-8599 Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability

    Apex One and OfficeScan

    Due May 3, 2022

  9. Added November 3, 2021

    CVE-2020-8468 Trend Micro Multiple Products Content Validation Escape Vulnerability

    Apex One, OfficeScan and Worry-Free Business Security Agents

    Due May 3, 2022

  10. Added November 3, 2021

    CVE-2020-8467 Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability

    Apex One and OfficeScan

    Due May 3, 2022

  11. Added November 3, 2021

    CVE-2020-24557 Trend Micro Multiple Products Improper Access Control Vulnerability

    Apex One, OfficeScan, and Worry-Free Business Security

    Due May 3, 2022

  12. Added November 3, 2021

    CVE-2019-18187 Trend Micro OfficeScan Directory Traversal Vulnerability

    OfficeScan

    Due May 3, 2022

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.

On Daily CISO, newest first

  1. Weekly archive · Jan 5 – Jan 11, 2026

    PoC Published for Critical Unauthenticated RCE in Trend Micro Apex Central

  2. Weekly archive · Sep 18 – Sep 24, 2023

    Trend Micro Apex One RCE Flaw Joins KEV Catalog

Sources

  1. Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
  2. Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
  3. CISO Tribune, vendor directory record for Trend Micro, published November 8, 2026