CVE-2026-34926A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents…
Updated under an hour ago ()
Does this affect you?
It affects Trend Micro, Inc. TrendAI Apex One and 2 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since May 21, 2026; federal agencies had to remediate by Jun 4, 2026. Treat that date as your deadline.
Do this next
Free account, 1 product
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
- CVSS
- 6.7 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
- Weakness (CWE)
- CWE-23
- Known exploited
- Added to CISA KEV May 21, 2026; federal remediation due Jun 4, 2026Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 0.54% (percentile 44)
- Assigned by
- trendmicro
- NVD analysis
- Analyzed
- Record last updated
- May 22, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Trend Micro, Inc. TrendAI Apex One trendmicro:apexone_op | 2019 (14.0) builds before 14.0.0.17079 | CNA record |
Trend Micro, Inc. TrendAI Apex One as a Service trendmicro:apexone_saas | from SaaS before 14.0.20731 | CNA record |
trendmicro apex_one trendmicro:apex_one | before 14.0.0.17079; before 14.0.20731 | NVD |
References
- https://success.trendmicro.com/en-US/solution/KA-0023430vendor-advisory
- https://success.trendmicro.com/ja-JP/solution/KA-0022974vendor-advisory
- https://jvn.jp/en/vu/JVNVU90583059/third-party-advisory
- https://www.jpcert.or.jp/english/at/2026/at260014.htmlthird-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926third-party-advisory, us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.