Vulnerability-Lookup

CVE-2026-34926 (GCVE-0-2026-34926)

Vulnerability from cvelistv5 – Published: 2026-05-21 13:03 – Updated: 2026-05-22 12:47

CISA KEV

Summary

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

Severity ?

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

CWE

CWE-23 - Relative Path Traversal

Assigner

trendmicro

References

4 references

URL	Tags
https://success.trendmicro.com/en-US/solution/KA-…
https://success.trendmicro.com/ja-JP/solution/KA-…
https://jvn.jp/en/vu/JVNVU90583059/
https://www.jpcert.or.jp/english/at/2026/at260014.html

Impacted products

2 products

Vendor	Product	Version
Trend Micro, Inc.	TrendAI Apex One	Affected: 2019 (14.0) , < 14.0.0.17079 (semver) cpe:2.3:a:trendmicro:apexone_op:14.0.0.17079:::::::*
Trend Micro, Inc.	TrendAI Apex One as a Service	Affected: SaaS , < 14.0.20731 (semver) cpe:2.3:a:trendmicro:apexone_saas:14.0.0.20731:::::::*

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 29739c2a-9ff9-4e9f-924c-b92c406a67b7

Vulnerability ID: CVE-2026-34926

Status: Confirmed

Status Updated: 2026-05-21 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-05-21

Asserted: 2026-05-21

Scope

Notes: KEV entry: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability | Affected: Trend Micro / Apex One | Description: Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2026-06-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://success.trendmicro.com/en-US/solution/KA-0023430 ; https://nvd.nist.gov/vuln/detail/CVE-2026-34926

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-23
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Apex One
Due Date	2026-06-04
Date Added	2026-05-21
Vendorproject	Trend Micro
Vulnerabilityname	Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2026-34926

Created: 2026-05-22 17:00 UTC | Updated: 2026-05-22 17:00 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34926",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-22T03:55:44.534070Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-05-21",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-22T12:47:07.213Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trendmicro:apexone_op:14.0.0.17079:*:*:*:*:*:*:*"
          ],
          "product": "TrendAI Apex One",
          "vendor": "Trend Micro, Inc.",
          "versions": [
            {
              "lessThan": "14.0.0.17079",
              "status": "affected",
              "version": "2019 (14.0)",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:trendmicro:apexone_saas:14.0.0.20731:*:*:*:*:*:*:*"
          ],
          "product": "TrendAI Apex One as a Service",
          "vendor": "Trend Micro, Inc.",
          "versions": [
            {
              "lessThan": "14.0.20731",
              "status": "affected",
              "version": "SaaS",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.\n\n\r\nThis vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-21T13:03:21.164Z",
        "orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
        "shortName": "trendmicro"
      },
      "references": [
        {
          "url": "https://success.trendmicro.com/en-US/solution/KA-0023430"
        },
        {
          "url": "https://success.trendmicro.com/ja-JP/solution/KA-0022974"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU90583059/"
        },
        {
          "url": "https://www.jpcert.or.jp/english/at/2026/at260014.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
    "assignerShortName": "trendmicro",
    "cveId": "CVE-2026-34926",
    "datePublished": "2026-05-21T13:03:21.164Z",
    "dateReserved": "2026-03-31T17:22:13.504Z",
    "dateUpdated": "2026-05-22T12:47:07.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2026-34926",
      "cwes": "[\"CWE-23\"]",
      "dateAdded": "2026-05-21",
      "dueDate": "2026-06-04",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://success.trendmicro.com/en-US/solution/KA-0023430 ; https://nvd.nist.gov/vuln/detail/CVE-2026-34926",
      "product": "Apex One",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.",
      "vendorProject": "Trend Micro",
      "vulnerabilityName": "Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability"
    },
    "epss": {
      "cve": "CVE-2026-34926",
      "date": "2026-05-22",
      "epss": "0.00253",
      "percentile": "0.48695"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34926\",\"sourceIdentifier\":\"security@trendmicro.com\",\"published\":\"2026-05-21T14:16:45.213\",\"lastModified\":\"2026-05-21T20:16:14.027\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.\\n\\n\\r\\nThis vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@trendmicro.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L\",\"baseScore\":6.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":0.8,\"impactScore\":5.3}]},\"cisaExploitAdd\":\"2026-05-21\",\"cisaActionDue\":\"2026-06-04\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability\",\"weaknesses\":[{\"source\":\"security@trendmicro.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-23\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/vu/JVNVU90583059/\",\"source\":\"security@trendmicro.com\"},{\"url\":\"https://success.trendmicro.com/en-US/solution/KA-0023430\",\"source\":\"security@trendmicro.com\"},{\"url\":\"https://success.trendmicro.com/ja-JP/solution/KA-0022974\",\"source\":\"security@trendmicro.com\"},{\"url\":\"https://www.jpcert.or.jp/english/at/2026/at260014.html\",\"source\":\"security@trendmicro.com\"},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34926\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-22T03:55:44.534070Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2026-05-21\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926\"}}}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-21T13:50:37.989Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:trendmicro:apexone_op:14.0.0.17079:*:*:*:*:*:*:*\"], \"vendor\": \"Trend Micro, Inc.\", \"product\": \"TrendAI Apex One\", \"versions\": [{\"status\": \"affected\", \"version\": \"2019 (14.0)\", \"lessThan\": \"14.0.0.17079\", \"versionType\": \"semver\"}]}, {\"cpes\": [\"cpe:2.3:a:trendmicro:apexone_saas:14.0.0.20731:*:*:*:*:*:*:*\"], \"vendor\": \"Trend Micro, Inc.\", \"product\": \"TrendAI Apex One as a Service\", \"versions\": [{\"status\": \"affected\", \"version\": \"SaaS\", \"lessThan\": \"14.0.20731\", \"versionType\": \"semver\"}]}], \"references\": [{\"url\": \"https://success.trendmicro.com/en-US/solution/KA-0023430\"}, {\"url\": \"https://success.trendmicro.com/ja-JP/solution/KA-0022974\"}, {\"url\": \"https://jvn.jp/en/vu/JVNVU90583059/\"}, {\"url\": \"https://www.jpcert.or.jp/english/at/2026/at260014.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.\\n\\n\\r\\nThis vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-23\", \"description\": \"CWE-23: Relative Path Traversal\"}]}], \"providerMetadata\": {\"orgId\": \"7f7bd7df-cffe-4fdb-ab6d-859363b89272\", \"shortName\": \"trendmicro\", \"dateUpdated\": \"2026-05-21T13:03:21.164Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34926\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-22T12:47:07.213Z\", \"dateReserved\": \"2026-03-31T17:22:13.504Z\", \"assignerOrgId\": \"7f7bd7df-cffe-4fdb-ab6d-859363b89272\", \"datePublished\": \"2026-05-21T13:03:21.164Z\", \"assignerShortName\": \"trendmicro\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-34926

Vulnerability from fkie_nvd - Published: 2026-05-21 14:16 - Updated: 2026-05-21 20:16

CISA KEV

Severity ?

6.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

Summary

References

	URL	Tags
	security@trendmicro.com	https://jvn.jp/en/vu/JVNVU90583059/
	security@trendmicro.com	https://success.trendmicro.com/en-US/solution/KA-0023430
	security@trendmicro.com	https://success.trendmicro.com/ja-JP/solution/KA-0022974
	security@trendmicro.com	https://www.jpcert.or.jp/english/at/2026/at260014.html
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cisaActionDue": "2026-06-04",
  "cisaExploitAdd": "2026-05-21",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.\n\n\r\nThis vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability."
    }
  ],
  "id": "CVE-2026-34926",
  "lastModified": "2026-05-21T20:16:14.027",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.3,
        "source": "security@trendmicro.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-21T14:16:45.213",
  "references": [
    {
      "source": "security@trendmicro.com",
      "url": "https://jvn.jp/en/vu/JVNVU90583059/"
    },
    {
      "source": "security@trendmicro.com",
      "url": "https://success.trendmicro.com/en-US/solution/KA-0023430"
    },
    {
      "source": "security@trendmicro.com",
      "url": "https://success.trendmicro.com/ja-JP/solution/KA-0022974"
    },
    {
      "source": "security@trendmicro.com",
      "url": "https://www.jpcert.or.jp/english/at/2026/at260014.html"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926"
    }
  ],
  "sourceIdentifier": "security@trendmicro.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "security@trendmicro.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4CCP-CQRH-3W9V

Vulnerability from github – Published: 2026-05-21 15:34 – Updated: 2026-05-21 21:30

Details

This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

Severity ?

6.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-34926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-21T14:16:45Z",
    "severity": "MODERATE"
  },
  "details": "A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.\n\n\nThis vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.",
  "id": "GHSA-4ccp-cqrh-3w9v",
  "modified": "2026-05-21T21:30:33Z",
  "published": "2026-05-21T15:34:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34926"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU90583059"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/en-US/solution/KA-0023430"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/ja-JP/solution/KA-0022974"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926"
    },
    {
      "type": "WEB",
      "url": "https://www.jpcert.or.jp/english/at/2026/at260014.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

JVNDB-2026-016802

Vulnerability from jvndb - Published: 2026-05-22 16:44 - Updated:2026-05-22 16:44

Severity ?

6.7 (Medium) - cvssV3_0 - CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

Summary

Multiple vulnerabilities in Trend Micro Endpoint security products for enterprises (May 2026)

Details

Multiple vulnerabilities in Trend Micro Endpoint security products for enterprises contain multiple vulnerabilities listed below.

Relative path traversal in Apex One server (CWE-23) - CVE-2026-34926
- The only product that could be vulnerable to this exploit is TrendAI Apex One (On Premise).
Origin validation error in Security Agent (CWE-346) - CVE-2026-34927,CVE-2026-34928,CVE-2026-34929,CVE-2026-34930,CVE-2026-45206,CVE-2026-45207
Time-of-check time-of-use (TOCTOU) race condition in Security Agent (CWE-367) - CVE-2026-45208

Trend Micro Incorporated has reported that attacks exploiting CVE-2026-34926 have been observed in the wild. Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU90583059/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-34926
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-34927
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-34928
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-34929
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-34930
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-45206
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-45207
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-45208
	Relative Path Traversal(CWE-23)	https://cwe.mitre.org/data/definitions/23.html
	Origin Validation Error(CWE-346)	https://cwe.mitre.org/data/definitions/346.html
	Time-of-check Time-of-use (TOCTOU) Race Condition(CWE-367)	https://cwe.mitre.org/data/definitions/367.html

Impacted products

Vendor

Product

	Trend Micro, Inc.	TrendAI Apex One
	Trend Micro, Inc.	TrendAI Vision One Endpoint Security - Standard Endpoint Protection
	Trend Micro, Inc.	Trend Micro Apex One

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-016802.html",
  "dc:date": "2026-05-22T16:44+09:00",
  "dcterms:issued": "2026-05-22T16:44+09:00",
  "dcterms:modified": "2026-05-22T16:44+09:00",
  "description": "Multiple vulnerabilities in Trend Micro Endpoint security products for enterprises contain multiple vulnerabilities listed below.\u003cul\u003e\u003cli\u003eRelative path traversal in Apex One server (CWE-23) - CVE-2026-34926\u003cul\u003e\u003cli\u003eThe only product that could be vulnerable to this exploit is TrendAI Apex One (On Premise).\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eOrigin validation error in Security Agent (CWE-346) - CVE-2026-34927,CVE-2026-34928,CVE-2026-34929,CVE-2026-34930,CVE-2026-45206,CVE-2026-45207\u003c/li\u003e\u003cli\u003eTime-of-check time-of-use (TOCTOU) race condition in Security Agent (CWE-367) - CVE-2026-45208\u003c/li\u003e\u003c/ul\u003eTrend Micro Incorporated has reported that attacks exploiting CVE-2026-34926 have been observed in the wild.\r\n\r\nTrend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-016802.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:trendmicro:trendai_apex_one",
      "@product": "TrendAI Apex One",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:trendmicro:trendai_vision_one_endpoint_security-standard_endpoint_protection",
      "@product": "TrendAI Vision One Endpoint Security - Standard Endpoint Protection",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:trendmicro:trend_micro_apex_one",
      "@product": "Trend Micro Apex One",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "6.7",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-016802",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU90583059/index.html",
      "@id": "JVNVU#90583059",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-34926",
      "@id": "CVE-2026-34926",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-34927",
      "@id": "CVE-2026-34927",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-34928",
      "@id": "CVE-2026-34928",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-34929",
      "@id": "CVE-2026-34929",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-34930",
      "@id": "CVE-2026-34930",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-45206",
      "@id": "CVE-2026-45206",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-45207",
      "@id": "CVE-2026-45207",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-45208",
      "@id": "CVE-2026-45208",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/23.html",
      "@id": "CWE-23",
      "@title": "Relative Path Traversal(CWE-23)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/346.html",
      "@id": "CWE-346",
      "@title": "Origin Validation Error(CWE-346)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/367.html",
      "@id": "CWE-367",
      "@title": "Time-of-check Time-of-use (TOCTOU) Race Condition(CWE-367)"
    }
  ],
  "title": "Multiple vulnerabilities in Trend Micro Endpoint security products for enterprises (May 2026)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-34926 (GCVE-0-2026-34926)

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

FKIE_CVE-2026-34926

GHSA-4CCP-CQRH-3W9V

JVNDB-2026-016802

Tags

Sightings

Nomenclature