CVE-2018-10357: Trend Micro Endpoint Application Control FileDrop servlet path traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and code execution impact, plus a very high EPSS score, though exploitation requires valid credentials and no KEV listing exists.

What it is

Trend Micro Endpoint Application Control 2.0 contains a directory traversal flaw in the FileDrop servlet (CWE-22). A remote attacker who is authenticated can traverse paths to reach files outside the intended directory, and the vendor and ZDI advisories confirm this can lead to arbitrary code execution on vulnerable installations.

Impact

An authenticated remote attacker can execute arbitrary code on the affected installation, giving full compromise of confidentiality, integrity and availability per the CVSS vector. This is a management/endpoint security component, so code execution there can undermine the protection it provides.

Attack surface

Reachable over the network through the FileDrop servlet (AV:N, AC:L). Authentication is required (PR:L) and no user interaction is needed (UI:N).

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at 0.73089 (99.43rd percentile), indicating substantial predicted exploitation activity. Reference tags are only vendor and third-party advisories, with no public exploit tag supplied.

What to do

• Apply the fix from the Trend Micro advisory (solution 1119811) as the first action.
• If patching cannot be done immediately, restrict network access to the FileDrop servlet to trusted management hosts.
• Review and minimize accounts with access to the affected interface, since exploitation requires authentication.
• Monitor the vendor advisory and ZDI-18-469 for any updated guidance or workarounds.

Detection

• Inspect web/proxy and application logs for traversal sequences (../, encoded variants) in requests to the FileDrop servlet.
• Alert on FileDrop servlet requests originating from unexpected or non-management source addresses.
• Look for post-request process creation or file writes on the Endpoint Application Control host that do not match normal administrative activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.