Apex One and Apex Central
CVE-2019-18187: OfficeScan Directory Traversal
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Trend Micro OfficeScan Version 11.0, XG (12 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.
Exploitation
CISA lists this CVE as exploited in the wild since 3 Nov 2021.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.