{"id":"CVE-2022-26871","kind":"vulnerability","aliases":["CVE-2022-26871"],"related":[],"title":"Trend Micro Apex Central: Trend Micro Apex Central Arbitrary File Upload Vulnerability","description":"An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.","summary":"Trend Micro Apex Central, the central management console for Trend Micro endpoint products, has an arbitrary file upload flaw. An attacker who can reach it can upload a file that leads to remote code execution on the server.","severity":"critical","cvss":9.8,"epss":0.19481,"exploited":true,"exploited_at":"2022-03-31T00:00:00+00:00","products":[{"name":"Trend Micro Apex Central","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apex-central","exploited","on-premises","trend-micro","vendor"],"not_affected_if":["managed-hosting","not-running-apex-central"],"how_to_check":"Identify Apex Central servers in your environment and confirm the installed build against Trend Micro's advisory; sources do not give a command or file path.","fix":"Apply the Trend Micro Apex Central updates per the vendor instructions (CISA required action); the fixed build is not named in the sources.","status":"open","published_at":"2022-03-29T21:15:07+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:19:40+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:19:40Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Trend Micro Apex Central updates per the vendor instructions (CISA required action); the fixed build is not named in the sources.\nunknown","reach":"network","impact":"high","summary":"Trend Micro Apex Central, the central management console for Trend Micro endpoint products, has an arbitrary file upload flaw. An attacker who can reach it can upload a file that leads to remote code execution on the server.","category":"vendor","who_cares":["trend-micro","apex-central","on-premises"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker uploads a file and runs code on the Apex Central server","analyst_note":"Find the affected and fixed Apex Central versions and any exposure or auth requirement in the Trend Micro advisory linked from the KEV entry.","how_to_check":"Identify Apex Central servers in your environment and confirm the installed build against Trend Micro's advisory; sources do not give a command or file path.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","not-running-apex-central"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00049,"input_tokens":2825,"output_tokens":415,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':14A,17A '-26871':15A,18A 'allow':83C 'apex':3A,7A,21A,24B,36B,80C 'apex-centr':23B 'arbitrari':9A,49B,73C,91C 'attack':54B,87C 'central':4A,8A,22A,25B,37B,39B,81C 'code':67B,98C 'consol':41B 'could':82C,94C 'cve':13A,16A 'endpoint':45B 'execut':68B,99C 'exploit':26B 'file':10A,50B,62B,74C,92C 'flaw':52B 'lead':64B,95C 'manag':40B 'micro':2A,6A,20A,32B,35B,44B,79C 'on-premis':27B 'premis':29B 'product':46B 'reach':57B 'remot':66B,86C,97C 'server':71B 'trend':1A,5A,19A,31B,34B,43B,78C 'trend-micro':30B 'unauthent':85C 'upload':11A,51B,60B,75C,89C 'vendor':33B 'vulner':12A,76C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-03-29T21:15:07+00:00","kev":{"dateAdded":"2022-03-31","dueDate":"2022-04-21","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-26871","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26871","severity":null,"published_at":"2022-03-31T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:36+00:00","note":null},{"source":"epss","external_id":"CVE-2022-26871","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26871","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-26871","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26871","severity":null,"published_at":"2022-03-29T21:15:07+00:00","modified_at":"2026-06-17T04:36:02+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}