CVE-2019-9488: Trend Micro Deep Security Manager

Medium severity, CVSS 4.9. EPSS: 1.2% chance of exploitation in the next 30 days.

Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM).

Affected products

• Trend Micro Deep Security Manager: version 10.0 only; version 11.0 only; version 11.3 only
• Trend Micro Vulnerability Protection: version 2.0 only

Published 2019-09-11. Last modified 2026-06-17.