Read the docs
TI-2026-27150 Aliases CVE-2026-34926GHSA-4ccp-cqrh-3w9v

Path traversal in TrendAI Apex One

Priority CRITICAL 89Exploited in the wildCWE-23Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

Why it matters now

Exploitation Active In CISA KEV since 2026-05-21CISA due date 2026-06-04
EPSS 0.1342 96th percentileScored 2026-11-07
Fix Fixed TrendAI Apex One (Trend Micro, Inc.): 14.0.0.17079TrendAI Apex One as a Service (Trend Micro, Inc.): 14.0.20731

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Trend MicroTrendAI Apex One2019 (14.0) to before 14.0.0.1707914.0.0.17079Patch availableCNA
Trend MicroTrendAI Apex One as a ServiceSaaS to before 14.0.2073114.0.20731Patch availableCNA
  • TrendAI Apex One VendorTrend Micro Affected 2019 (14.0) to before 14.0.0.17079 Fixed in 14.0.0.17079 Patch available CNA
  • TrendAI Apex One as a Service VendorTrend Micro Affected SaaS to before 14.0.20731 Fixed in 14.0.20731 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:*before 14.0.0.17079VulnerableTrendmicro
cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:*before 14.0.20731VulnerableTrendmicro
  • cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:* Versions before 14.0.0.17079 Vulnerable ·Trendmicro
  • cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:* Versions before 14.0.20731 Vulnerable ·Trendmicro

Remediation

  • Fix · CNA TrendAI Apex One (Trend Micro, Inc.) Fixed in 14.0.0.17079
  • Fix · CNA TrendAI Apex One as a Service (Trend Micro, Inc.) Fixed in 14.0.20731

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Trend Micro TrendAI Apex One, TrendAI Apex One as a Service 14.0.0.17079, 14.0.20731

    8 records Highest priority Priority CRITICAL 1 CRITICAL, 7 LOW

    Other records, highest priority first

    • TI-2026-33025 Time-of-check time-of-use race condition in TrendAI Apex OnePriority LOW 36
    • TI-2026-27153 Origin validation error in TrendAI Apex OnePriority LOW 36
    • TI-2026-27151 Origin validation error in TrendAI Apex OnePriority LOW 36
    Show all 8 records →

Timeline

  1. 2026-05-21 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-34926
  3. 2026-10-03 Alias added: GHSA-4ccp-cqrh-3w9v
  4. 2026-10-25 EPSS moved to the 95th–99th percentile

References

Advisory 5

  • TI-2025-34668 OS command injection in Trend Micro Apex One KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-10115 Insufficient verification of data authenticity in Trend Micro Apex Central KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06895 Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-14867 Unrestricted file upload in Trend Micro Apex One KEVCVSS 3.1HIGH 8.8
  • TI-2020-06795 Injection in Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free… KEVCVSS 3.1HIGH 8.8
  • TI-2020-06794 A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a… KEVCVSS 3.1HIGH 8.8
See all 603 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences