CVE-2019-18187: Trend Micro OfficeScan directory traversal enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in CISA KEV with known exploitation and a high EPSS percentile, and can lead to remote code execution, though the record notes execution is bound to a possibly restricted web service account.

What it is

Trend Micro OfficeScan 11.0 and XG (12.0) contain a directory traversal flaw (CWE-22) that lets an attacker extract files from an arbitrary zip archive into a chosen folder on the OfficeScan server. Because the extracted content can land in a web-served location, this can escalate to remote code execution under the web service account. The flaw is remotely reachable and has been listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker can write attacker-controlled files into arbitrary server folders and potentially execute code as the web service account, whose privileges depend on the web platform. Even without code execution, the traversal allows unauthorized file extraction on the server.

Attack surface

Reachable over the network against the OfficeScan server's web interface. The description states an attempted attack requires user authentication, though the CVSS 3.1 vector lists PR:N and UI:N, so the record is internally inconsistent on whether credentials are needed.

Exploitation

Listed in CISA KEV (added 2021-11-03, due 2022-05-03) indicating known exploitation in the wild, and EPSS 30-day probability is 0.25125 (97.8th percentile). No ransomware campaign use is documented and no public exploit reference is included in the record.

What to do

• Apply the vendor update referenced in Trend Micro solution 000151730 (use the archived copy if the live link is broken).
• Restrict network access to the OfficeScan server web interface to trusted management networks.
• Enforce strong authentication and least-privilege for OfficeScan web service accounts.
• Monitor and constrain zip upload/extraction functionality on the OfficeScan server.
• Verify remediation against CISA KEV required action guidance.

Detection

• Audit OfficeScan server file system for unexpected files written outside intended upload or extraction directories.
• Monitor web server logs for requests that include traversal sequences (../) targeting OfficeScan endpoints.
• Alert on new or modified executable files in web-accessible directories on the OfficeScan host.
• Track process creation by the OfficeScan web service account for unusual child processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.