CVE-2026-34926

Published May 21, 2026

Last updated 23 days ago

Exploit known CVSS medium 6.7

Zero-day

Apex One (on-premise)

Apex One

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-34926 is a directory traversal vulnerability found in the on-premise version of Trend Micro Apex One. This flaw enables a pre-authenticated local attacker to alter a key table on the server. By modifying this table, an attacker can inject malicious code, which is subsequently deployed to agents on affected installations. Exploitation of this vulnerability requires the attacker to have local access to the Apex One Server and already possess administrative credentials for that server. Trend Micro has noted instances of attempted exploitation of this vulnerability in real-world scenarios, leading to its inclusion in CISA's Known Exploited Vulnerabilities catalog.

Description: A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
Source: security@trendmicro.com
NVD status: Analyzed
Products: apex_one

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.7
Impact score: 5.3
Exploitability score: 0.8
Vector string: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
Exploit added on: May 21, 2026
Exploit action due: Jun 4, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security@trendmicro.com: CWE-23

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:*",
            "matchCriteriaId": "6F20657B-98A4-46BE-8481-12060262C850",
            "versionEndExcluding": "14.0.0.17079",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:*",
            "matchCriteriaId": "322053CC-D396-412E-9F81-7640FE9DB7BD",
            "versionEndExcluding": "14.0.20731",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.