CVE-2026-34926
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
Description
CVE-2026-34926 is a medium-severity directory traversal (relative path traversal) vulnerability in Trend Micro Apex One (on-premise), an enterprise endpoint security platform. The flaw lets an attacker who already has local access and administrative credentials to the Apex One server modify a key table on the server, injecting malicious code that is then deployed to managed agents across the installation. Although exploitation requires significant pre-existing access, the scope is changed — a compromise of the management server propagates malicious code to every protected endpoint, turning a security product into a malware distribution channel. CISA added CVE-2026-34926 to its Known Exploited Vulnerabilities catalog, so on-premise Apex One operators should apply the vendor fix promptly.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:LOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| trendmicro | apex one | < 14.0.0.17079; < 14.0.20731 |
References
- https://jvn.jp/en/vu/JVNVU90583059/(Third Party Advisory)
- https://success.trendmicro.com/en-US/solution/KA-0023430(Vendor Advisory)
- https://success.trendmicro.com/ja-JP/solution/KA-0022974(Vendor Advisory)
- https://www.jpcert.or.jp/english/at/2026/at260014.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926(Third Party Advisory, US Government Resource)
Weakness Type
CWE-23: Relative Path Traversal
In Apex One (on-premise), the relative path traversal weakness allows an attacker to use traversal sequences to escape the intended directory scope and reach and modify a key table on the server. By writing outside the intended location, the attacker can inject malicious code that the server subsequently distributes to its managed agents.
Learn more: CWE-23 — Relative Path Traversal
Impact Analysis
CVE-2026-34926 carries a CVSS 3.1 score of 6.7 (MEDIUM). The attack vector is local with high attack complexity and requires high privileges, meaning the attacker must already have access to the Apex One server and administrative credentials obtained through some other means, and no user interaction is needed. What elevates the seriousness despite these preconditions is the changed scope: by modifying a key table on the management server, the attacker can inject code that is deployed to all managed agents, so the impact reaches well beyond the vulnerable server itself, with high confidentiality impact and low integrity and availability impact. The EPSS score is low at 0.19% (40.9th percentile), but the CISA KEV listing indicates this directory traversal flaw is being exploited in the wild, and a compromised endpoint protection deployment is an especially high-value foothold for attackers.
Exploit Maturity
CVE-2026-34926 is on the CISA Known Exploited Vulnerabilities catalog, indicating confirmed exploitation concern, even though the EPSS score remains low at 0.19% (40.9th percentile) — consistent with a vulnerability that requires substantial pre-existing access and is therefore used in targeted rather than mass attacks. No tagged public proof-of-concept appears in the NVD references; the available sources are vendor and CERT advisories, including the Trend Micro advisory, JPCERT/CC alert, and a JVN advisory. Because the vulnerability lets an attacker turn the Apex One management server into a distribution point for malicious code to every agent, defenders should patch promptly and treat any anomalous administrative activity on the server as a potential precursor to exploitation.
Remediation
- Apply mitigations per vendor instructions as mandated by the CISA KEV deadline of 2026-06-04: upgrade Apex One (on-premise) to a fixed build — versions before 14.0.0.17079 and before 14.0.20731 are affected — per the Trend Micro advisory (KA-0023430).
- Tightly control administrative access to the Apex One server, since exploitation depends on an attacker first obtaining local access and administrative credentials; enforce strong authentication, least privilege, and network segmentation around the management server.
- Monitor the Apex One server for unauthorized modifications to its key tables and for unexpected agent deployment packages, which would indicate attempted or successful code injection.
- Review server and agent logs for signs of malicious code being pushed to endpoints, and audit managed agents for unexpected binaries or configuration changes after patching.
- As long-term hardening against relative path traversal, validate and canonicalize all server-side file paths against an allowlist of permitted directories so traversal sequences cannot escape the intended scope.
Technical Details
CVE-2026-34926 is a relative path traversal vulnerability (CWE-23) in the on-premise Apex One server. An attacker with local access and previously obtained administrative credentials can supply traversal sequences that break out of the intended directory and modify a key table on the server; because that table influences what is deployed to agents, the modification injects malicious code that the server then distributes to managed endpoints. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L) captures the trade-off: the attack is local, complex, and privilege-gated, but the scope is changed, so the consequences extend from the management server to every agent it controls. Trend Micro notes the vulnerability is only exploitable on the on-premise version of Apex One, and that the attacker must already have access to the server and administrative credentials acquired through another method.
Frequently Asked Questions
Is CVE-2026-34926 being actively exploited?
CVE-2026-34926 is listed on the CISA Known Exploited Vulnerabilities catalog, indicating confirmed exploitation. Its EPSS score is low at 0.19% because exploitation requires significant pre-existing access, so it is more likely used in targeted attacks than in mass scanning.
What products are affected by CVE-2026-34926?
The vulnerability affects Trend Micro Apex One (on-premise) in versions before 14.0.0.17079 and before 14.0.20731. The cloud-hosted version of Apex One is not affected; only on-premise deployments are vulnerable.
How do I fix CVE-2026-34926?
Upgrade Apex One (on-premise) to a fixed build per the Trend Micro advisory KA-0023430. Tighten administrative access to the management server and monitor for unauthorized key-table modifications, since exploitation requires an attacker to first gain local server access with admin credentials.
How severe is CVE-2026-34926?
CVE-2026-34926 is rated MEDIUM with a CVSS 3.1 score of 6.7. Although exploitation requires local access and administrative credentials, the changed scope means a compromised Apex One server can deploy malicious code to all managed agents, making the real-world impact significant for affected organizations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.