Deep Security and Cloud One
CVE-2024-51503: Security agent manual scan command injection in Trend Micro Deep Security
A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Trend Micro Deep Security 20 | 20.0.1-21510 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine. In certain circumstances, attackers that have legitimate access to the domain may be able to remotely inject commands to other machines in the same domain.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability locally and must have domain user privileges to affect other machines.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.