CVE-2026-34926
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA notes
https://success.trendmicro.com/en-US/solution/KA-0023430 ; https://nvd.nist.gov/vuln/detail/CVE-2026-34926
Description
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
Severity
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:LExploitation Context
as of October 14, 2026- CISA added CVE-2026-34926 to the KEV catalog on the day its CVE record was published. The median for entries added in 2026 so far is 15 days.
- It is one of 12 Trend Micro entries in the CISA KEV catalog, and the only one added in 2026.
- Its current EPSS score (0.5%) is higher than that of 1% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Trend Micro, Inc. | Trend Micro, Inc. TrendAI Apex One | 2019 (14.0) to <14.0.0.17079 |
| Trend Micro, Inc. | Trend Micro, Inc. TrendAI Apex One as a Service | SaaS to <14.0.20731 |
References
4 LinksRecord Details
More from Trend Micro
Trend Micro Apex One OS Command Injection Vulnerability
Trend Micro OfficeScan Directory Traversal Vulnerability
Trend Micro Apex Central Arbitrary File Upload Vulnerability
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.