{"id":"CVE-2026-34926","kind":"vulnerability","aliases":["CVE-2026-34926"],"related":[],"title":"trendmicro apex one: A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local…","description":"A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.\n\n\r\nThis vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.","summary":"Trend Micro Apex One on-premise has a directory traversal flaw that lets a pre-authenticated local attacker modify a key table on the server. The attacker can inject malicious code that the server then deploys to managed agents.","severity":"high","cvss":6.7,"epss":null,"exploited":true,"exploited_at":"2026-05-21T00:00:00+00:00","products":[{"name":"Trend Micro Apex One","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"trendmicro apex one","fixed":["14.0.0.17079"],"affected":"< 14.0.0.17079","ecosystem":"vendor"},{"name":"trendmicro apex one","fixed":["14.0.20731"],"affected":"< 14.0.20731","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["endpoint-management","exploited","infrastructure","on-premise","trend-micro-apex-one"],"not_affected_if":["apex-one-saas","no-on-premise-server"],"how_to_check":null,"fix":"Apply the mitigations from Trend Micro's vendor advisory, or discontinue use of the product if mitigations are unavailable (per CISA required action).","status":"open","published_at":"2026-05-21T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:34:05+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:34:05Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from Trend Micro's vendor advisory, or discontinue use of the product if mitigations are unavailable (per CISA required action).","summary":"Trend Micro Apex One on-premise has a directory traversal flaw that lets a pre-authenticated local attacker modify a key table on the server. The attacker can inject malicious code that the server then deploys to managed agents.","category":"infrastructure","who_cares":["trend-micro-apex-one","on-premise","endpoint-management"],"confidence":0.6,"analyst_note":"Find the Trend Micro advisory for CVE-2026-34926 to get affected and fixed versions, the specific mitigation steps, and a check for whether the server was tampered with; CISA KEV entry is the only source so far.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["apex-one-saas","no-on-premise-server"],"severity_if_unknown":"high"},"cost_usd":0.000373,"input_tokens":2095,"output_tokens":326,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':24A,27A '-34926':25A,28A 'access':152C 'administr':161C 'affect':130C 'agent':92B,128C 'allow':17A,106C 'alreadi':159C 'apex':2A,10A,31A,34A,37A,50B,54B,99C,144C,155C 'attack':71B,80B,112C,149C 'authent':21A,69B,110C 'code':84B,124C 'could':16A,105C 'credenti':162C 'cve':23A,26A 'deploy':89B,126C 'directori':5A,61B,94C 'endpoint':40B 'endpoint-manag':39B 'exploit':42B,136C,171C 'flaw':63B 'infrastructur':43B 'inject':82B,122C 'instal':131C 'key':74B,116C 'let':65B 'local':22A,70B,111C 'malici':83B,123C 'manag':41B,91B 'method':169C 'micro':30A,49B,53B 'modifi':72B,114C 'must':150C 'obtain':160C 'on-premis':12A,44B,56B,101C,139C 'one':3A,11A,32A,35A,38A,51B,55B,100C,145C,156C 'potenti':148C 'pre':20A,68B,109C 'pre-authent':19A,67B,108C 'premis':14A,46B,58B,103C,141C 'server':15A,78B,87B,104C,120C,157C,165C 'tabl':75B,117C 'travers':6A,62B,95C 'trend':29A,48B,52B 'trend-micro-apex-on':47B 'trendmicro':1A,33A,36A 'version':142C 'via':166C 'vulner':7A,96C,133C,173C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-21T00:00:00+00:00","kev":{"dateAdded":"2026-05-21","dueDate":"2026-06-04","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","cvss_by":"security@trendmicro.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-34926","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34926","severity":null,"published_at":"2026-05-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-34926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34926","severity":null,"published_at":"2026-05-21T14:16:45+00:00","modified_at":"2026-07-23T16:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}