CVE-2023-41179: Trend Micro Apex One AV uninstaller module command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows arbitrary command execution and is listed in CISA KEV as exploited in the wild, though it requires prior administrative console access, which limits the attack surface.

What it is

The third-party AV uninstaller module in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security, and Worry-Free Business Security Services can be manipulated to execute arbitrary commands. The flaw is a code injection issue (CWE-94) that requires the attacker to already hold administrative console access on the target system.

Impact

An attacker with administrative console access can run arbitrary commands on the affected installation, gaining code execution in the security product's context. This can lead to full compromise of the management server and the endpoints it controls.

Attack surface

Reached over the network (AV:N) with low attack complexity and no user interaction, but it requires high privileges (PR:H), meaning the attacker must first obtain administrative console access. No authentication bypass is described; the console access is a precondition.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2023-09-21 with a remediation due date of 2023-10-12, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.04739 (91.4th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor's fixed version for Apex One (on-prem and SaaS), Worry-Free Business Security, and Worry-Free Business Security Services as directed in Trend Micro solution 000294994.
• If a patch is not immediately available, follow CISA's required action to apply vendor mitigations or discontinue use of the affected product.
• Restrict and monitor administrative console access, enforcing least privilege and strong authentication for console users.
• Audit console accounts and remove or disable unused administrative accounts that could be used as a foothold.
• Monitor for unexpected command execution or process creation originating from the AV uninstaller module.

Detection

• Monitor for suspicious child processes spawned by the Trend Micro AV uninstaller module or its parent services.
• Alert on unusual command-line arguments or script execution originating from Apex One or Worry-Free Business Security management components.
• Review administrative console login and configuration-change logs for anomalous or unauthorized activity.
• Hunt for known post-exploitation behavior on management servers, such as new service creation or scheduled tasks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.