Summary
CVE-2026-34926 is a directory traversal vulnerability affecting Trend Micro Apex One (on-premise). An attacker who already has administrative access to the Apex One server can exploit the flaw to modify a key server table and deploy malicious code to managed agents. The issue impacts Apex One on-premise server and agent builds earlier than 14.0.0.17079, and Apex One as a Service/TrendAI Vision One Standard Endpoint Protection agent builds earlier than 14.0.20731. TrendAI has confirmed attempted in-the-wild exploitation, and the vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog. Organizations should update affected installations to the recommended fixed versions as soon as possible.
Urgent Actions Required
- Upgrade Apex One (on-premise) to SP1 CP Build 18012 (existing SP1 deployments) or SP1 Build 17079 (new installations). Ensure Security Agent build 14.0.0.17079 or later is deployed.
- Update Apex One as a Service and TrendAI Vision One Standard Endpoint Protection to Security Agent build 14.0.20731 or later.
- Restrict administrative access to the Apex One server, review remote access permissions, and monitor the server for unauthorized modifications or suspicious deployment activity.
Which Systems Are Vulnerable to CVE-2026-34926?
Technical Overview
- Vulnerability Type: Directory Traversal (CWE-23)
-
Affected Software/Versions:
- Trend Micro Apex One (on-premise) 2019 - Server and Agent builds earlier than 14.0.0.17079
- Apex One as a Service - Security Agent builds earlier than 14.0.20731
- TrendAI Vision One™ Endpoint Security - Standard Endpoint Protection - Security Agent builds earlier than 14.0.20731
-
CVSS Vector: v3.1
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: High
- User Interaction: None
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low
- Patch Availability: Yes, available
How Does the CVE-2026-34926 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-34926?
Vulnerability Root Cause:
CVE-2026-34926 is a directory traversal (CWE-23) vulnerability in the Trend Micro Apex One (on-premise) server. An attacker with existing administrative access can modify a key server table to inject malicious code into managed Apex One agents.
How Can You Mitigate CVE-2026-34926?
If immediate patching is delayed or not possible:
- Restrict administrative and remote access to the Apex One server.
- Monitor the server for unauthorized modifications and suspicious deployment activity.
- Review remote access policies and ensure perimeter security controls are up to date.
- Follow the vendor’s recommended mitigation guidance until updates can be applied.
- If mitigations are unavailable, consider discontinuing use of the affected product as advised by CISA.
Which Assets and Systems Are at Risk?
-
Asset Types Affected:
- Endpoint Security Management Servers - Trend Micro Apex One on-premise servers running affected versions
- Managed Endpoints - Systems protected by Apex One agents that receive deployments from the affected server
- Endpoint Protection Platforms - Apex One (on-premise), Apex One as a Service, and TrendAI Vision One™ Endpoint Security - Standard Endpoint Protection with vulnerable agent builds
-
Business-Critical Systems at Risk:
- Apex One Management Servers - An attacker with local administrative access can modify a key table and inject malicious code
- Managed Endpoint Devices - Malicious code can be distributed to connected security agents from the compromised server
- Enterprise Endpoint Security Infrastructure - A successful attack can compromise the integrity of centrally managed endpoint protection
-
Exposure Level:
- On-premise Apex One Deployments - Vulnerable if running affected server builds
- Systems with Local Administrative Access to the Apex One Server - Exploitation requires an attacker to already possess administrative privileges on the server
- Environments That Have Not Applied the Vendor Updates - Systems remain exposed until the recommended builds are installed
Will Patching CVE-2026-34926 Cause Downtime?
Patch application impact: Low. Updating to the recommended TrendAI builds typically requires a maintenance window and may cause brief service interruption.
Mitigation (if immediate patching is not possible): Restrict access to Apex One servers, review administrative access, strengthen perimeter security, and monitor for suspicious activity until the update can be applied.
How Can You Detect CVE-2026-34926 Exploitation?
Exploitation Signatures:
Look for unauthorized modifications to Apex One server components or key tables, unexpected code deployment to managed agents, and suspicious changes on the Apex One server.
Indicators of Compromise (IOCs/IOAs):
- Unexpected changes to key tables on the Apex One server
- Unapproved code or software deployments to managed endpoints
- Suspicious activity involving Apex One server administrative accounts
Behavioral Indicators:
- Unexpected agent updates or code deployments
- Unexplained changes to the Apex One server
- Unusual activity involving privileged Apex One administrator accounts
Alerting Strategy:
- Priority: High
- Alert on unauthorized changes to the Apex One server, unexpected agent deployments, and suspicious use of administrative accounts.
Remediation & Response
-
Remediation Timeline:
- Immediate: Apply the vendor-recommended updates to affected Apex One deployments.
- After Update: Verify all affected servers and agents are running the recommended builds.
-
Incident Response Considerations:
- Review Apex One server activity for unauthorized changes.
- Investigate unexpected agent code deployments.
- Monitor systems for suspicious administrative account activity.
- Validate that all affected systems have been successfully updated.
Master Modern Endpoint Detection and Response with Fidelis Endpoint®
-
-
- Explore the architecture behind scalable, enterprise-grade EDR
- Learn how automation, threat hunting, and forensic visibility accelerate response
- Discover advanced endpoint investigation and containment capabilities
- Get practical insights to strengthen endpoint security operations
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 6.7 | Medium-severity vulnerability |
| Attack Vector | Local | Exploitation requires access to the affected Apex One server |
| Attack Complexity | High | Successful exploitation requires specific conditions |
| Privileges Required | High | Administrative privileges on the Apex One server are required |
| User Interaction | None | No user action is needed after exploitation begins |
| Scope | Changed | Successful exploitation can impact managed endpoint agents |
| Confidentiality Impact | High | Sensitive information may be exposed |
| Integrity Impact | Low | Unauthorized modification of server data is possible |
| Availability Impact | Low | Limited impact on service availability |
References:
