CVE-2023-52338 is a high severity (7.8) link following flaw in the Trend Micro Deep Security Agent 20.0 for Windows, including Cloud One Endpoint and Workload Security. A local attacker can escalate privileges. Trend Micro fixed it in agent build 20.0.0-8438, so update to that build or later.
What's affected
Trend Micro lists the Deep Security Agent 20.0 on Windows as affected, including the Cloud One Endpoint and Workload Security Agent. The fixed build in its bulletin is 20.0.0-8438 for Windows (20 LTS Update 2023-12-12), listed as available now.
The attacker needs a foothold first. Both the NVD text and the Zero Day Initiative advisory say the attacker must already be able to run low-privileged code on the machine. The vector is local: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
The Trend Micro bulletin covers more than one local privilege escalation. It adds that one of the listed issues may have been fixed in an earlier patch, and it advises customers to take the latest cumulative build instead of working out which one they need.
Weakness class: CWE-59.
How to check if you're exposed
Find the agent version on each Windows host. The Deep Security Manager console lists the agent version per computer, and the Help Center describes where to read it on the host. Anything on 20.0 below build 20.0.0-8438 is in scope.
If you manage agents through Cloud One Endpoint and Workload Security, use its computer list and filter by agent version in the same way.
Because the flaw needs local code execution first, rank hosts by who can log in. Shared servers, terminal servers and build machines carry the most risk.
What to do now
- Update Windows Deep Security Agents on the 20 LTS line to build 20.0.0-8438 or later, using the vendor Download Center.
- Prefer the latest cumulative build, as the bulletin advises.
- Review who has interactive or remote access to hosts that run the agent, as the bulletin recommends for this class of flaw.
- Confirm the new build in the console after the rollout.
Why it matters
A link following flaw means a privileged service follows a filesystem link that an unprivileged user can plant. According to the Zero Day Initiative advisory, the service in the Trend Micro Anti-Malware Solution Platform can be abused through a symbolic link to delete a file, and that can be used to reach code execution as SYSTEM. I am describing the class at the level the advisory does and no further.
Endpoint security agents run with high privileges on every host, so a local flaw in one turns a minor foothold into full control of the machine. The CVE is not in the CISA Known Exploited Vulnerabilities catalog per the record. The ZDI timeline shows the issue reported to the vendor on 2023-09-07 and coordinated public release on 2024-01-19.
Quick check
Can this be exploited remotely?
Not directly. Both Trend Micro and ZDI describe a local flaw that needs the attacker to run low-privileged code on the machine first.
Which build fixes it?
Trend Micro lists Deep Security Agent 20.0.0-8438 for Windows (20 LTS Update 2023-12-12). Check the bulletin for newer cumulative builds.
Sources
Last reviewed: 19 October 2026.
