CVE-2019-9489

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-05 · updated 2026-06-17
Weakness: CWE-22

Description

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (versions XG and 11.0), and Worry-Free Business Security (versions 10.0, 9.5 and 9.0) could allow an attacker to modify arbitrary files on the affected product's management console.

Affected products

Trend Micro Apex One: through b1066
Trendmicro Apex One As A Service: before 2019-03-27 — fixed in 2019-03-27
Trendmicro Business Security: 9.0-sp3
Trend Micro OfficeScan: 11.0-sp1, xg, xg-sp1
Trend Micro Worry-Free Business Security: 9.5, 10.0

How to fix

Upgrade to a fixed version: Trendmicro Apex One As A Service 2019-03-27. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-9489 or the next vulnerability affects your stack