CVE-2026-34926
MediumExploitedPublic exploitMultiple vulnerabilities in Trend Micro Endpoint security products for enterprises (May 2026)
Published May 25, 2026 · Updated Jul 23, 2026 · Also known as JVNDB-2026-016802
Key Facts
Patch immediately- CVE-2026-34926 is a medium-severity vulnerability (CVSS 6.7 v3.1) affecting Apex One (Trendmicro), Apexone Op (Trendmicro), Apexone Saas (Trendmicro).
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 21, 2026. Public exploit code is available.
- EPSS estimates a 0.5% probability of exploitation in the next 30 days.
- Fixed versions are available, including Apex One 14.0.0.17079, Apex One 14.0.20731, Apexone Op 14.0.0.17079.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
6.7
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
EPSS (30-day exploit likelihood)
0.5%
Higher than 44.0% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-34926 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | May 21, 2026 | Jun 4, 2026 | Not reported |
| Industry KEV feed | May 21, 2026 | Jun 4, 2026 | Not reported |
| CIRCL KEV | May 21, 2026 | Jun 4, 2026 | Not reported |
| ENISA EUVD | May 21, 2026 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Products
7 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Apex OneTrendmicro | See advisory | 14.0.0.17079 |
| Apexone OpTrendmicro | 14.0.0.17079 | 14.0.0.17079 |
| Apexone SaasTrendmicro | 14.0.0.20731 | 14.0.20731 |
Patched Releases
Apex One
14.0.0.17079, 14.0.20731
Apexone Op
14.0.0.17079
Apexone Saas
14.0.20731
Timeline
Added to CISA KEV
May 21, 2026
Added to Industry KEV feed
May 21, 2026
Added to CIRCL KEV
May 21, 2026
Added to ENISA EUVD
May 21, 2026
Publicly disclosed
May 25, 2026
Last updated
Jul 23, 2026
Weakness Type
- CWE-23 Relative Path Traversal
- CWE-346 Origin Validation Error
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
References
- advisoryJVN JVNDB-2026-016802
- advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926
- exploitVulnCheck exploitation report
- otherVulnCheck exploitation report
- otherVulnCheck exploitation report
FAQ
Common Questions.
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
Affected: Apex One (Trendmicro); Apexone Op (Trendmicro) versions 14.0.0.17079; Apexone Saas (Trendmicro) versions 14.0.0.20731. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 21, 2026.
Yes. It was added on May 21, 2026 with a federal remediation due date of Jun 4, 2026.
Public exploit code is available.
Fixed versions are available, including Apex One 14.0.0.17079, Apex One 14.0.20731, Apexone Op 14.0.0.17079.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2026-34926 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo