CVE-2019-18187
Trend Micro OfficeScan Directory Traversal Vulnerability
Published Oct 28, 2019 · updated Jun 16, 2026 · trendmicro officescan
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.
Timeline
Detection, updates, and resolution for this record.
Oct 28, 2019 · Catalog
Detected
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have res
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have res
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe trendmicro/officescan11.0
- cpe trendmicro/officescanxg
- vendor Trend Micro OfficeScanversion unspecified
Sources
- CISA KEVCVE-2019-18187
Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.
cisa.gov - CVE.orgCVE-2019-18187
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-18187
30-day exploitation probability 25.1%
first.org - NIST NVDCVE-2019-18187
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE
nvd.nist.gov