CVE-2016-6268

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-01-30 · updated 2026-06-17
Weakness: CWE-264

Description

Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to execute arbitrary code with root privileges via a Trojan horse .war file in the Solr webapps directory.

Affected products

Trend Micro Smart Protection Server (Standalone): 2.5, 2.6, 3.0

References

https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/
https://success.trendmicro.com/solution/1114913
https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/
https://success.trendmicro.com/solution/1114913

Get alerted when CVE-2016-6268 or the next vulnerability affects your stack