CVE-2016-9269

Severity: critical (CVSS 9.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-02-21 · updated 2026-06-17
Weakness: CWE-264

Description

Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update functionality. This was resolved in Version 6.5 CP 1737.

Affected products

Trend Micro InterScan Web Security Virtual Appliance: through 6.5

References

http://www.securityfocus.com/bid/96252
http://www.securitytracker.com/id/1037849
https://success.trendmicro.com/solution/1116672
http://www.securityfocus.com/bid/96252
http://www.securitytracker.com/id/1037849
https://success.trendmicro.com/solution/1116672

Get alerted when CVE-2016-9269 or the next vulnerability affects your stack