CVE-2023-52337: High Local Privilege Escalation in Deep Security

CVE-2023-52337 is a high severity (7.8) local privilege escalation in the Trend Micro Deep Security 20.0 agent and the Cloud One Endpoint and Workload Security agent on Windows. An attacker needs low privileged code execution first. Trend Micro fixed it in agent 20.0.0-8438, so update to that build or later.

What's affected

The NVD record names Trend Micro Deep Security 20.0 and the Trend Micro Cloud One Endpoint and Workload Security Agent. Trend Micro's bulletin narrows it: the affected product is the Deep Security Agent, including Cloud One Endpoint and Workload Security, version 20.0 on Windows. The fix is Deep Security Agent 20.0.0-8438 for Windows, the 20 LTS update of 2023-12-12, listed as available.

The weakness is CWE-269, improper privilege management, and the vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which gives 7.8 (High). Trend Micro and ZDI advisory ZDI-24-075 give the same score, so there is no conflict on severity. The bulletin also says one of the CVEs it lists may have been fixed in an earlier patch, and tells customers to take the newest cumulative build.

ZDI places the flaw in the Anti-Malware Solution Platform: the product applies insufficient access controls to a sensitive folder, which can be used to escalate to SYSTEM.

How to check if you're exposed

This is a Windows agent, so check the installed agent version on each server and workstation that runs it. In a command prompt on a protected machine, the agent's own tool reports its status:

"%ProgramFiles%\Trend Micro\Deep Security Agent\dsa_query.cmd"

I did not find the exact output field in the sources, so treat the Deep Security Manager console as the main source: it lists each agent's version in the computer details. Anything below 20.0.0-8438 on the 20 LTS line is below the fixed build in the bulletin.

Also consider who can run code on those machines. A local privilege escalation matters wherever low privileged users, service accounts or remote desktop users share a host with the agent.

What to do now

1. List all Windows machines running the Deep Security Agent 20.0, or the Cloud One Endpoint and Workload Security agent, from the manager console.
2. Schedule the upgrade to 20.0.0-8438 or a newer cumulative build, using the Deep Security Help Center instructions linked in the bulletin.
3. Prioritise shared hosts first: terminal servers, build machines and jump boxes, where low privileged users already have a session.
4. Review local administrator and remote desktop membership on those hosts, and remove access that is not needed.
5. Confirm the new version in the console after deployment, and keep the console's update policy set so agents pick up later builds.

Why it matters

Improper privilege management means the product gives a lower privileged account access it should not have. Here the issue is a sensitive folder with weak access controls inside the anti-malware component, and the outcome in ZDI's text is code running as SYSTEM, the highest privilege on a Windows machine.

The bulletin stresses that an attacker must first run low privileged code, so this is a second stage bug. That is exactly how it becomes useful: an attacker who phishes a standard user or lands on a host through a web flaw can use it to take the whole machine. Security agents run with high privilege everywhere, which makes them an attractive target. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you keep track of the components you run and the advisories that apply to them.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Trend Micro security bulletin for Deep Security local privilege escalation
• Zero Day Initiative advisory ZDI-24-075
• Gold page for CVE-2023-52337

Last reviewed: 19 October 2026.