Executive Summary

CVE-2026-34926 is a directory traversal vulnerability in the Apex One (on-premise) server.

This vulnerability allows a pre-authenticated local attacker who already has administrative credentials on the Apex One server to modify a key table on the server.

By modifying this table, the attacker can inject malicious code that will be deployed to agents on affected installations.

It is exploitable only on the on-premise version of Apex One and requires the attacker to have access to the server and administrative credentials obtained by other means.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with administrative access to the Apex One server to inject malicious code into key server tables.

The injected malicious code can then be distributed to security agents on affected installations, potentially compromising endpoint security.

Such an attack could lead to unauthorized code execution, privilege escalation, and compromise of the security infrastructure.

Trend Micro has confirmed that this vulnerability has been exploited in the wild, highlighting the real risk to affected users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-34926, you should immediately apply the security patches and updates released by Trend Micro for Apex One (on-premise) and related products.

• Update Apex One (on-premise) server to the latest version, including Service Pack 1 Critical Patch B18012 or later.
• Apply updates to Apex One as a Service and Vision One Endpoint Security - Standard Endpoint Protection agents as provided by Trend Micro.
• Ensure that only authorized administrators have access to the Apex One server to reduce risk of exploitation.

Trend Micro strongly recommends applying these patches as soon as possible to prevent exploitation, as this vulnerability has been observed in the wild.

Useful 0 Not Useful 0