Trend Micro warns of Apex One zero-day exploited in the wild

Summary

Trend Micro has addressed a zero-day vulnerability, CVE-2026-34926, in its Apex One endpoint security platform. The directory traversal flaw allows local attackers with admin privileges to inject malicious code, and CISA has ordered federal agencies to patch it by June 4.

Full text

Trend Micro warns of Apex One zero-day exploited in the wild By Sergiu Gatlan May 22, 2026 09:39 AM 0 Japanese cybersecurity software company Trend Micro has addressed an Apex One zero-day vulnerability exploited in attacks targeting Windows systems. Apex One is Trend Micro's enterprise-grade endpoint security platform that protects corporate networks from a wide range of security threats, including malware, ransomware, fileless attacks, and web-based threats. Tracked as CVE-2026-34926, this directory traversal vulnerability in the Apex One (on-premises) server allows local attackers with admin privileges to inject malicious code. "A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations," Trend Micro saidon Thursday. "This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability." However, despite the restrictive requirements for successful exploitation, the company warned that "TrendAI has observed at least one attempt to exploit this vulnerability in the wild." Federal agencies ordered to patch within three weeks Yesterday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also added CVE-2026-34926 to its list of actively exploited vulnerabilities and ordered federal agencies to patch their devices by June 4. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA warned. "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable." On Thursday, Trend Micro also released security updates to address seven local privilege escalation vulnerabilities in the Apex One Standard Endpoint Protection (SEP) agent that attackers can exploit if they have permission to execute low-privileged code on the target system. Threat actors have frequently targeted flaws in Trend Micro Apex One over the last several years, often in zero-day attacks. For instance, Trend Micro warned of an actively exploited Apex One RCE bug (CVE-2025-54948) in August 2025 and addressed two other Apex One zero-days exploited in the wild in September 2022 (CVE-2022-40139) and September 2023 (CVE-2023-41179). CISA currently tracks 12 Trend Micro Apex vulnerabilities that have either been or are still being abused in attacks. The Validation Gap: Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.This guide covers the 6 surfaces you actually need to validate. Download Now Related Articles: CISA orders feds to patch Gogs RCE flaw exploited in zero-day attacksMicrosoft warns of new Defender zero-days exploited in attacksPalo Alto Networks firewall zero-day exploited for nearly a monthCISA orders feds to patch Windows flaw exploited as zero-dayCISA gives feds 4 days to patch actively exploited cPanel plugin flaw

Indicators of Compromise

• cve — CVE-2026-34926
• cve — CVE-2025-54948
• cve — CVE-2022-40139
• cve — CVE-2023-41179

Entities