DaystoPatch

VendorsSecurity

Trend Micro

Trend Micro, which brands its enterprise business TrendAI, makes Apex One and Apex Central endpoint security, Vision One, Deep Security and Worry-Free Business Security, and runs the Zero Day Initiative.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
21 May 2026
Incidents on record
2

Response to exploited bugs

Not rated. 2 reviewed zero-days on record. A grade needs at least 3.

Fixing privately reported bugs

61 range 53ā€“69rank 18 of 20

Medium confidence, 65 private reports

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a Dāˆ’. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: not rated. 2 reviewed zero-days in the last 36 months. A grade needs at least 3.
  • First fix within a day for 1 of 2 zero-days. The other one took 10 days.
  • Every supported version fixed within a day for 1 of 2 zero-days. The other one took 10 days.
  • First advisory within a day for all 2 zero-days.
  • Fixing privately reported bugs: C (61). Median 194 days from private report to fix (65 cases, 5 with a vendor fix date). 55 of 65 took longer than ZDI's 120-day deadline. ZDI, the source of these cases, is run by this vendor.

Response to exploited bugs: sub-scores

  • Time to first advisory2 of 2 zero-days within a day
    80
    2 cases, low confidence, not used for this vendor
  • Time to first fix1 of 2 zero-days within a day, longest 10 days
    76
    2 cases, low confidence, not used for this vendor
  • Time to fix all versions1 of 2 zero-days within a day, longest 10 days
    79
    2 cases, low confidence, not used for this vendor
  • OpennessAdvisories published as CSAF. 2 of 2 zero-days with a dated revision history. 2 of 2 fixed zero-days with a public fix date for every version. 1 of 1 zero-day not fixed within a day had an advisory or mitigation within 72 hours.
    80
    5 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

  • Private fix speedMedian 194 days from private report to fix (65 cases, 5 with a vendor fix date)
    61C
    65 cases, medium confidence, weight 100%

Response fingerprint

Median of 2 graded zero-days. Vendor statement 0h, first fix 5.2d, all versions 5.2d.

Compressed time scale

Counts toward the response grade 2

  1. 21 May 2026Trend Micro Apex One (on-prem) server directory traversal, fixed before public disclosure (CVE-2026-34926)
  2. 5 Aug 2025Trend Micro Apex One (on-prem) management console command injection exploited before patch
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

2 in 24 months, 0 with known ransomware use, 100% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
21 May 2026Trend Micro Apex One (on-prem) server directory traversal, fixed before public disclosure (CVE-2026-34926)CVE-2026-349266.70hsame daysame dayFixedCounts toward grade
5 Aug 2025Trend Micro Apex One (on-prem) management console command injection exploited before patchCVE-2025-54948, CVE-2025-549879.40h10d10dFixedCounts toward grade

Private reports

Median 194 days, 85% over 120 days, 0 published unpatched

Bugs reported privately to Trend Micro by ZDI or Project Zero.

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
10 Sep 2026ZDI-26-652CVE-2025-71416Apex One245to publicationYes
10 Sep 2026ZDI-26-320, ZDI-26-321, ZDI-26-322, ZDI-26-323, ZDI-26-324, ZDI-26-653CVE-2025-71415, CVE-2026-34927, CVE-2026-34928, CVE-2026-34929, CVE-2026-34930, CVE-2026-45206Vision One; Apex One316to publicationYes
10 Sep 2026ZDI-26-654CVE-2025-71414Apex One337to publicationYes
29 Jul 2026ZDI-26-498CVE-2025-71387Vision One299to publicationYes
29 Jul 2026ZDI-26-497CVE-2025-71386Vision One315to publicationYes
28 May 2026ZDI-26-325CVE-2026-45207Vision One80to vendor fix, 21 May 2026Yes
28 May 2026ZDI-26-136, ZDI-26-137, ZDI-26-326CVE-2025-71210, CVE-2025-71211, CVE-2026-45208Apex One; Vision One252to vendor fix, 21 May 2026Yes
15 Apr 2026ZDI-26-269, ZDI-26-270CVE-2025-54948, CVE-2025-54987Apex One232to publicationYes
3 Mar 2026ZDI-26-149CVE-2025-71218Cleaner One Pro69to publicationYes
3 Mar 2026ZDI-26-140CVE-2025-71213Apex One305to publicationYes
Show all 65 private reports
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
3 Mar 2026ZDI-26-141, ZDI-26-142, ZDI-26-143CVE-2025-71215, CVE-2025-71216, CVE-2025-71217Apex One329to publicationYes
3 Mar 2026ZDI-26-139CVE-2025-71214Apex One338to publicationYes
3 Mar 2026ZDI-26-147, ZDI-26-148CVE-2025-71208, CVE-2025-71209Apex Central349to publicationYes
3 Mar 2026ZDI-26-144, ZDI-26-145, ZDI-26-146CVE-2025-71205, CVE-2025-71206, CVE-2025-71207Apex Central364to publicationYes
3 Mar 2026ZDI-25-363, ZDI-26-138CVE-2025-49156, CVE-2025-71212Apex One566to publicationYes
17 Dec 2025ZDI-25-1125CVE-2025-53503Cleaner One Pro125to publicationYes
5 Aug 2025ZDI-25-771, ZDI-25-772CVE-2025-54948, CVE-2025-54987Apex One4to publicationYes
11 Jul 2025ZDI-25-588CVE-2025-53503Cleaner One Pro105to publicationYes
11 Jul 2025ZDI-25-589CVE-2025-53378Worry-Free Business Security126to vendor fix, 27 Jun 2025Yes
8 Jul 2025ZDI-25-585CVE-2025-52521Maximum Security95to publicationYes
8 Jul 2025ZDI-25-586CVE-2025-52837Password Manager145to publicationYes
17 Jun 2025ZDI-25-365, ZDI-25-380, ZDI-25-398CVE-2025-49158, CVE-2025-49384, CVE-2025-49385Apex One; Maximum Security; Internet Security193to publicationYes
11 Jun 2025ZDI-25-361CVE-2025-48443Password Manager148to publicationYes
11 Jun 2025ZDI-25-367CVE-2025-49220Apex Central208to publicationYes
11 Jun 2025ZDI-25-366CVE-2025-49219Apex Central210to publicationYes
11 Jun 2025ZDI-25-368, ZDI-25-369, ZDI-25-370, ZDI-25-371, ZDI-25-372, ZDI-25-373, ZDI-25-374, ZDI-25-375CVE-2025-49211, CVE-2025-49212, CVE-2025-49213, CVE-2025-49215, CVE-2025-49216, CVE-2025-49217, CVE-2025-49218Endpoint Encryption243to publicationYes
11 Jun 2025ZDI-25-364CVE-2025-49157Apex One251to vendor fix, 9 Jun 2025Yes
11 Jun 2025ZDI-25-004, ZDI-25-005, ZDI-25-006, ZDI-25-362CVE-2024-52048, CVE-2024-52049, CVE-2024-55917, CVE-2025-49155Apex One332to vendor fix, 9 Jun 2025Yes
11 Jun 2025ZDI-25-360CVE-2025-49487Worry-Free Business Security456to publicationYes
21 May 2025ZDI-25-295, ZDI-25-296, ZDI-25-297CVE-2025-47865, CVE-2025-47866, CVE-2025-47867Apex Central230to publicationYes
9 Apr 2025ZDI-25-241CVE-2025-30642Deep Security111to publicationYes
9 Apr 2025ZDI-25-238CVE-2025-30680Apex Central160to publicationYes
9 Apr 2025ZDI-25-236, ZDI-25-239, ZDI-25-240CVE-2025-30640, CVE-2025-30641, CVE-2025-30678Apex Central; Deep Security216to publicationYes
9 Apr 2025ZDI-25-237CVE-2025-30679Apex Central217to publicationYes
7 Apr 2025ZDI-25-201CVE-2025-27529Cleaner One Pro89to publicationYes
8 Jan 2025ZDI-25-008CVE-2024-55955Deep Security139to publicationYes
8 Jan 2025ZDI-25-003CVE-2024-55632Apex One189to publicationYes
8 Jan 2025ZDI-25-002CVE-2024-52050Apex One194to publicationYes
8 Jan 2025ZDI-25-001CVE-2024-55631Apex One234to publicationYes
8 Jan 2025ZDI-25-007CVE-2024-52047Apex One328to publicationYes
19 Nov 2024ZDI-24-1516CVE-2024-51503Deep Security91to publicationYes
17 Oct 2024ZDI-24-1419CVE-2024-48903Deep Security161to publicationYes
17 Oct 2024ZDI-24-1418CVE-2024-48904Cloud Edge254to publicationYes
17 Sep 2024ZDI-24-1227, ZDI-24-1228CVE-2024-46902, CVE-2024-46903Deep Discovery Inspector32to publicationYes
30 Jul 2024ZDI-24-1022CVE-2024-41183VPN Proxy One Pro146to publicationYes
30 Jul 2024ZDI-24-1023CVE-2024-41183VPN Proxy One Pro179to publicationYes
5 Jul 2024ZDI-24-897CVE-2024-39753Apex One143to publicationYes
10 Jun 2024ZDI-24-585CVE-2024-36473VPN Proxy One Pro134to publicationYes
6 Jun 2024ZDI-24-576CVE-2024-32849Maximum Security144to publicationYes
6 Jun 2024ZDI-24-572, ZDI-24-575CVE-2024-36305, CVE-2024-36358Apex One; Deep Security155to publicationYes
6 Jun 2024ZDI-24-571CVE-2024-36304Apex One183to publicationYes
6 Jun 2024ZDI-24-573CVE-2024-36307Apex One188to publicationYes
6 Jun 2024ZDI-24-570CVE-2024-36303Apex One197to publicationYes
6 Jun 2024ZDI-24-052, ZDI-24-568, ZDI-24-569CVE-2023-52331, CVE-2024-36302, CVE-2024-36306Apex Central; Apex One247to publicationYes
6 Jun 2024ZDI-24-574CVE-2024-36359InterScan Web Security Virtual Appliance275to publicationYes
6 Jun 2024ZDI-24-577CVE-2024-37289Apex One289to publicationYes
19 Jan 2024ZDI-24-076CVE-2023-52338Deep Security134to publicationYes
19 Jan 2024ZDI-24-024, ZDI-24-077CVE-2023-52324, CVE-2023-52325Apex Central185to publicationYes
19 Jan 2024ZDI-24-078, ZDI-24-079, ZDI-24-080CVE-2023-41176, CVE-2023-41177, CVE-2023-41178Mobile Security for Enterprises263to publicationYes
19 Jan 2024ZDI-24-075CVE-2023-52337Deep Security560to publicationYes
18 Jan 2024ZDI-24-021, ZDI-24-022, ZDI-24-023, ZDI-24-074CVE-2023-52326, CVE-2023-52327, CVE-2023-52328, CVE-2023-52329Apex Central385to publicationYes
11 Jan 2024ZDI-24-051CVE-2023-52330Apex Central120to publicationYes
10 Jan 2024ZDI-24-028, ZDI-24-029CVE-2023-52093, CVE-2023-52094Apex One146to publicationYes
10 Jan 2024ZDI-24-026, ZDI-24-027CVE-2023-52090, CVE-2023-52091Apex One160to publicationYes
10 Jan 2024ZDI-24-025CVE-2023-52092Apex One162to publicationYes

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get Trend Micro's own alerts

What we watch

  • Advisory pageTrend Micro vulnerability response (security bulletins)
  • CSAFTrend Micro CSAF provider metadata

See sources and health for when each was last read.