CVE WatchJul 23, 2026

CVE-2026-34926

Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

CVSS

6.7

Medium

EPSS

0.5%

p44

KEV

YES

May 21, 2026

Exploit Today

0-100

Published: May 21, 2026 · Last modified: Jul 23, 2026 · CWE-23

EPSS · 30d

0.5%EPSS · 30 days12.7%

2026-09-172026-10-15

KEV catalog record

Product

Trend Micro / Apex One

Vulnerability

Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

Added to KEV

May 21, 2026

Remediate by

Jun 4, 2026

Known ransomware use

Summary description

Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://success.trendmicro.com/en-US/solution/KA-0023430 ; https://nvd.nist.gov/vuln/detail/CVE-2026-34926

Technical description

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1110937.5 HIG

—

——0In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files21h CVE-2026-1107467.8 HIG

—

——0A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.22h CVE-2026-103508—

—

——0P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier. Perforce resolved it in 2026.4.3.19h CVE-2026-41545—

44.3%

——13A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later22h CVE-2026-39993—

28.4%

——9A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later22h CVE-2026-765199.8 CRI

77.4%

KEV—73Cisco Secure Email Gateway Relative Path Traversal Vulnerability1d