CVE-2026-34926
Directory Traversal in Apex One On-Premise Server
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: Trend Micro, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trend_micro | apex_one | 17079 |
| trend_micro | apex_one_as_a_service | 14.0.20731 |
| trend_micro | vision_one_endpoint_security | 14.0.20731 |
| trend_micro | security_agent | 14.0.17079 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-23 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34926 is a directory traversal vulnerability in the Apex One (on-premise) server.
This vulnerability allows a pre-authenticated local attacker who already has administrative credentials on the Apex One server to modify a key table on the server.
By modifying this table, the attacker can inject malicious code that will be deployed to agents on affected installations.
It is exploitable only on the on-premise version of Apex One and requires the attacker to have access to the server and administrative credentials obtained by other means.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with administrative access to the Apex One server to inject malicious code into key server tables.
The injected malicious code can then be distributed to security agents on affected installations, potentially compromising endpoint security.
Such an attack could lead to unauthorized code execution, privilege escalation, and compromise of the security infrastructure.
Trend Micro has confirmed that this vulnerability has been exploited in the wild, highlighting the real risk to affected users.
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2026-34926, you should immediately apply the security patches and updates released by Trend Micro for Apex One (on-premise) and related products.
- Update Apex One (on-premise) server to the latest version, including Service Pack 1 Critical Patch B18012 or later.
- Apply updates to Apex One as a Service and Vision One Endpoint Security - Standard Endpoint Protection agents as provided by Trend Micro.
- Ensure that only authorized administrators have access to the Apex One server to reduce risk of exploitation.
Trend Micro strongly recommends applying these patches as soon as possible to prevent exploitation, as this vulnerability has been observed in the wild.