Live › vulnerability › CVE-2022-40139
Go to dashboardTrend Micro Apex One and Apex One as a Service have an improper validation flaw in the rollback mechanism of their components. An attacker can use it to run code remotely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Trend Micro Apex One and Apex One as a Service | vendor | – | – |
| trendmicro apex one | vendor | – | – |
| trendmicro apex one | vendor | = 2019 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2022-40139")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.