CVE-2019-18189: Trend Micro Apex One

Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days.

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow an attacker to bypass authentication and log on to an affected product's management console as a root user. The vulnerability does not require authentication.

Affected products

• Trend Micro Apex One: any version
• Trend Micro OfficeScan: version 11.0 only; version xg only
• Trend Micro Worry-Free Business Security: version 9.5 only; version 10.0 only

Published 2019-10-28. Last modified 2026-06-17.