{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "TrendAI has released updates to Apex One (on-premise), Apex One as a Service and Vision One - Standard Endpoint Protection (SEP) to resolve multiple vulnerabilities. ! ITW Notification: TrendAI has observed at least one instance of an attempt to actively exploit one of these vulnerabilities in the wild.",
        "title": "Summary"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. TREND MICRO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\n\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Trend Micro products.",
        "title": "Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/legalcode) If you distribute this content, or a modified version of it, you must provide attribution to Trend Micro, Inc. and provide a link to the original.",
        "title": "Document License"
      },
      {
        "category": "summary",
        "text": "Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. In addition to timely application of patches and updated solutions, customers are also advised to review remote access to critical systems and ensure policies and perimeter security is up-to-date.",
        "title": "Mitigating Factors"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@trendmicro.com",
      "issuing_authority": "TrendAI PSIRT is responsible for vulnerability handling across all TrendAI supported products, including any end-of-life products.",
      "name": "TrendAI (Trend Micro) PSIRT",
      "namespace": "https://www.trendmicro.com/vulnerability"
    },
    "references": [
      {
        "category": "self",
        "summary": "TrendAI Security Bulletin",
        "url": "https://success.trendmicro.com/en-US/solution/KA-0023430"
      },
      {
        "category": "self",
        "summary": "2026-0521-TM-A1-001 - CSAF Version",
        "url": "https://www.trendmicro.com/.well-known/csaf/2026/2026-0521-tm-a1-001.json"
      }
    ],
    "title": "ITW SECURITY BULLETIN: Apex One and Vision One and Standard Endpoint Protection (SEP) May 2026 Security Bulletin",
    "tracking": {
      "aliases": [
        "KA-0019917"
      ],
      "current_release_date": "2026-05-21T13:00:00.000Z",
      "generator": {
        "date": "2026-05-19T14:43:54.988Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.1"
        }
      },
      "id": "2026-0521-TM-A1-001",
      "initial_release_date": "2026-05-21T13:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-05-21T13:00:00.000Z",
          "number": "1",
          "summary": "Initial version."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c14.0.0.17079",
                "product": {
                  "name": "Trend Micro Apex One (2019) On-prem\u003c14.0.0.17079",
                  "product_id": "TM-A1-001"
                }
              },
              {
                "category": "product_version",
                "name": "14.0.0.17079",
                "product": {
                  "name": "Trend Micro Apex One (2019) On-prem SP1 CP Build 17079",
                  "product_id": "TM-A1-002",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:trendmicro:apexone_op:14.0.0.17079:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Apex One"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c14.0.20731",
                "product": {
                  "name": "Trend Micro Apex One as a Service \u003c14.0.20731",
                  "product_id": "TM-A1SAAS-001"
                }
              },
              {
                "category": "product_version",
                "name": "14.0.20731",
                "product": {
                  "name": "Trend Micro Apex One as a Service 14.0.20731",
                  "product_id": "TM-A1SAAS-002",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:trendmicro:apexone_saas:14.0.0.20731:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Apex One as a Service"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c14.0.0.17079",
                "product": {
                  "name": "Trend Micro Apex One (2019) On-prem Security Agent\u003c14.0.0.17079",
                  "product_id": "TM-A1-003"
                }
              },
              {
                "category": "product_version",
                "name": "14.0.0.17079",
                "product": {
                  "name": "Trend Micro Apex One (2019) On-prem Security Agent SP1 CP Build 17079",
                  "product_id": "TM-A1-004"
                }
              }
            ],
            "category": "product_name",
            "name": "Apex One Security Agent"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c14.0.20731",
                "product": {
                  "name": "Trend Micro Apex One as a Service Agent\u003c14.0.20731",
                  "product_id": "TM-A1SAAS-003"
                }
              },
              {
                "category": "product_version",
                "name": "14.0.20731",
                "product": {
                  "name": "Trend Micro Apex One as a Service Security Agent 14.0.20731",
                  "product_id": "TM-A1SAAS-004"
                }
              }
            ],
            "category": "product_name",
            "name": "Apex One as a Service Security Agent"
          }
        ],
        "category": "vendor",
        "name": "Trend Micro"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "TrendAI Incident Response (IR) Team"
          ]
        }
      ],
      "cve": "CVE-2026-34926",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "description",
          "text": "A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.",
          "title": "CVE description"
        },
        {
          "category": "description",
          "text": "This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.",
          "title": "Preconditions"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-A1-002",
          "TM-A1-004",
          "TM-A1SAAS-002",
          "TM-A1SAAS-004"
        ],
        "known_affected": [
          "TM-A1-001",
          "TM-A1-003",
          "TM-A1SAAS-001",
          "TM-A1SAAS-003"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to SP1 CP Build 17079 or later",
          "product_ids": [
            "TM-A1-001",
            "TM-A1-003"
          ],
          "url": "http://downloadcenter.trendmicro.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to Security Agent Version 14.0.20731 or later",
          "product_ids": [
            "TM-A1SAAS-001",
            "TM-A1SAAS-003"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.6,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "TM-A1-001",
            "TM-A1-003",
            "TM-A1SAAS-001",
            "TM-A1SAAS-003"
          ]
        }
      ],
      "title": "Server Directory Traversal Vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Lays (@_L4ys)"
          ],
          "organization": "TRAPA Security",
          "summary": "working with Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "cve": "CVE-2026-34927",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "notes": [
        {
          "category": "description",
          "text": "An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.",
          "title": "CVE description"
        },
        {
          "category": "description",
          "text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
          "title": "Preconditions"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-A1-002",
          "TM-A1-004"
        ],
        "known_affected": [
          "TM-A1-001",
          "TM-A1-003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-27959",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to SP1 CP Build 17079 or later",
          "product_ids": [
            "TM-A1-001",
            "TM-A1-003"
          ],
          "url": "http://downloadcenter.trendmicro.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to Security Agent Version 14.0.20731 or later",
          "product_ids": [
            "TM-A1SAAS-001",
            "TM-A1SAAS-003"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-A1-001",
            "TM-A1-003"
          ]
        }
      ],
      "title": "Security Agent Origin Validation Error Local Privilege Vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Lays (@_L4ys)"
          ],
          "organization": "TRAPA Security",
          "summary": "working with Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "cve": "CVE-2026-34927",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "notes": [
        {
          "category": "description",
          "text": "An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.",
          "title": "CVE description"
        },
        {
          "category": "description",
          "text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
          "title": "Preconditions"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-A1-002",
          "TM-A1-004"
        ],
        "known_affected": [
          "TM-A1-001",
          "TM-A1-003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-27959",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to SP1 CP Build 17079 or later",
          "product_ids": [
            "TM-A1-001",
            "TM-A1-003"
          ],
          "url": "http://downloadcenter.trendmicro.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to Security Agent Version 14.0.20731 or later",
          "product_ids": [
            "TM-A1SAAS-001",
            "TM-A1SAAS-003"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-A1-001",
            "TM-A1-003"
          ]
        }
      ],
      "title": "Security Agent Origin Validation Error Local Privilege Vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Lays (@_L4ys)"
          ],
          "organization": "TRAPA Security",
          "summary": "working with Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "cve": "CVE-2026-34929",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "notes": [
        {
          "category": "description",
          "text": "An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism.",
          "title": "CVE description"
        },
        {
          "category": "description",
          "text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
          "title": "Preconditions"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-A1-002",
          "TM-A1-004"
        ],
        "known_affected": [
          "TM-A1-001",
          "TM-A1-003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-28077",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to SP1 CP Build 17079 or later",
          "product_ids": [
            "TM-A1-001",
            "TM-A1-003"
          ],
          "url": "http://downloadcenter.trendmicro.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to Security Agent Version 14.0.20731 or later",
          "product_ids": [
            "TM-A1SAAS-001",
            "TM-A1SAAS-003"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-A1-001",
            "TM-A1-003"
          ]
        }
      ],
      "title": "Security Agent Origin Validation Error Local Privilege Vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Lays (@_L4ys)"
          ],
          "organization": "TRAPA Security",
          "summary": "working with Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "cve": "CVE-2026-34930",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "notes": [
        {
          "category": "description",
          "text": "An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different process protection mechanism.",
          "title": "CVE description"
        },
        {
          "category": "description",
          "text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
          "title": "Preconditions"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-A1-002",
          "TM-A1-004"
        ],
        "known_affected": [
          "TM-A1-001",
          "TM-A1-003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-28089",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to SP1 CP Build 17079 or later",
          "product_ids": [
            "TM-A1-001",
            "TM-A1-003"
          ],
          "url": "http://downloadcenter.trendmicro.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to Security Agent Version 14.0.20731 or later",
          "product_ids": [
            "TM-A1SAAS-001",
            "TM-A1SAAS-003"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-A1-001",
            "TM-A1-003"
          ]
        }
      ],
      "title": "Security Agent Origin Validation Error Local Privilege Vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Lays (@_L4ys)"
          ],
          "organization": "TRAPA Security",
          "summary": "working with Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "cve": "CVE-2026-45206",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "notes": [
        {
          "category": "description",
          "text": "An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism.",
          "title": "CVE description"
        },
        {
          "category": "description",
          "text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
          "title": "Preconditions"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-A1-002",
          "TM-A1-004"
        ],
        "known_affected": [
          "TM-A1-001",
          "TM-A1-003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-28118",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to SP1 CP Build 17079 or later",
          "product_ids": [
            "TM-A1-001",
            "TM-A1-003"
          ],
          "url": "http://downloadcenter.trendmicro.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to Security Agent Version 14.0.20731 or later",
          "product_ids": [
            "TM-A1SAAS-001",
            "TM-A1SAAS-003"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-A1-001",
            "TM-A1-003"
          ]
        }
      ],
      "title": "Security Agent Origin Validation Error Local Privilege Vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Lays (@_L4ys)"
          ],
          "organization": "TRAPA Security",
          "summary": "working with Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "cve": "CVE-2026-45207",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "notes": [
        {
          "category": "description",
          "text": "An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45206 but exists in a different process protection communication mechanism.",
          "title": "CVE description"
        },
        {
          "category": "description",
          "text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
          "title": "Preconditions"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-A1-002",
          "TM-A1-004"
        ],
        "known_affected": [
          "TM-A1-001",
          "TM-A1-003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-29177",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to SP1 CP Build 17079 or later",
          "product_ids": [
            "TM-A1-001",
            "TM-A1-003"
          ],
          "url": "http://downloadcenter.trendmicro.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to Security Agent Version 14.0.20731 or later",
          "product_ids": [
            "TM-A1SAAS-001",
            "TM-A1SAAS-003"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-A1-001",
            "TM-A1-003"
          ]
        }
      ],
      "title": "Security Agent Origin Validation Error Local Privilege Vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Lays (@_L4ys)"
          ],
          "organization": "TRAPA Security",
          "summary": "working with Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "cve": "CVE-2026-45208",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "notes": [
        {
          "category": "description",
          "text": "A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.",
          "title": "CVE description"
        },
        {
          "category": "description",
          "text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
          "title": "Preconditions"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-A1-002",
          "TM-A1-004"
        ],
        "known_affected": [
          "TM-A1-001",
          "TM-A1-003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-27982",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to SP1 CP Build 17079 or later",
          "product_ids": [
            "TM-A1-001",
            "TM-A1-003"
          ],
          "url": "http://downloadcenter.trendmicro.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2026-05-21T13:00:00.000Z",
          "details": "Update to Security Agent Version 14.0.20731 or later",
          "product_ids": [
            "TM-A1SAAS-001",
            "TM-A1SAAS-003"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-A1-001",
            "TM-A1-003"
          ]
        }
      ],
      "title": "Security Agent Time-Of-Check Time-Of-Use Local Privilege Vulnerability"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "TrendAI Vision One SEP sans le correctif 14.0.20731",
      "product": {
        "name": "Vision One",
        "vendor": {
          "name": "Trend Micro",
          "scada": false
        }
      }
    },
    {
      "description": "Apex One sans le correctif de s\u00e9curit\u00e9 SP1 CP Build 18012",
      "product": {
        "name": "Apex One",
        "vendor": {
          "name": "Trend Micro",
          "scada": false
        }
      }
    },
    {
      "description": "Apex One sans le correctif de s\u00e9curit\u00e9 SP1 CP Build 17079 (pour une nouvelle installation)",
      "product": {
        "name": "Apex One",
        "vendor": {
          "name": "Trend Micro",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-45208",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45208"
    },
    {
      "name": "CVE-2026-45206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45206"
    },
    {
      "name": "CVE-2026-45207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45207"
    },
    {
      "name": "CVE-2026-34928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34928"
    },
    {
      "name": "CVE-2026-34926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34926"
    },
    {
      "name": "CVE-2026-34930",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34930"
    },
    {
      "name": "CVE-2026-34929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34929"
    },
    {
      "name": "CVE-2026-34927",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34927"
    }
  ],
  "initial_release_date": "2026-05-22T00:00:00",
  "last_revision_date": "2026-05-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0642",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Trend Micro. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges et un contournement de la politique de s\u00e9curit\u00e9.\n\nTrend Micro indique que la vuln\u00e9rabilit\u00e9 CVE-2026-34926 est activement exploit\u00e9e",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Trend Micro",
  "vendor_advisories": [
    {
      "published_at": "2026-05-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Trend Micro KA-0023430",
      "url": "https://success.trendmicro.com/en-US/solution/KA-0023430"
    }
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:trendmicro:apexone_op:14.0.0.17079:*:*:*:*:*:*:*"
          ],
          "product": "TrendAI Apex One",
          "vendor": "Trend Micro, Inc.",
          "versions": [
            {
              "lessThan": "14.0.0.17079",
              "status": "affected",
              "version": "2019 (14.0)",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:trendmicro:apexone_saas:14.0.0.20731:*:*:*:*:*:*:*"
          ],
          "product": "TrendAI Apex One as a Service",
          "vendor": "Trend Micro, Inc.",
          "versions": [
            {
              "lessThan": "14.0.20731",
              "status": "affected",
              "version": "SaaS",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@trendmicro.com"
    }
  ],
  "cisaActionDue": "2026-06-04",
  "cisaExploitAdd": "2026-05-21",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:on-premises:windows:*:*",
              "matchCriteriaId": "6F20657B-98A4-46BE-8481-12060262C850",
              "versionEndExcluding": "14.0.0.17079",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:*",
              "matchCriteriaId": "322053CC-D396-412E-9F81-7640FE9DB7BD",
              "versionEndExcluding": "14.0.20731",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.\n\n\r\nThis vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability."
    }
  ],
  "id": "CVE-2026-34926",
  "lastModified": "2026-06-17T10:39:49.727",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.3,
        "source": "security@trendmicro.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34926",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-22T03:55:44.534070Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-21T14:16:45.213",
  "references": [
    {
      "source": "security@trendmicro.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/vu/JVNVU90583059/"
    },
    {
      "source": "security@trendmicro.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://success.trendmicro.com/en-US/solution/KA-0023430"
    },
    {
      "source": "security@trendmicro.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://success.trendmicro.com/ja-JP/solution/KA-0022974"
    },
    {
      "source": "security@trendmicro.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.jpcert.or.jp/english/at/2026/at260014.html"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926"
    }
  ],
  "sourceIdentifier": "security@trendmicro.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "security@trendmicro.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-34926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-21T14:16:45Z",
    "severity": "MODERATE"
  },
  "details": "A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.\n\n\nThis vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.",
  "id": "GHSA-4ccp-cqrh-3w9v",
  "modified": "2026-05-21T21:30:33Z",
  "published": "2026-05-21T15:34:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34926"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU90583059"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/en-US/solution/KA-0023430"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/ja-JP/solution/KA-0022974"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926"
    },
    {
      "type": "WEB",
      "url": "https://www.jpcert.or.jp/english/at/2026/at260014.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-016802.html",
  "dc:date": "2026-05-25T15:38+09:00",
  "dcterms:issued": "2026-05-22T16:44+09:00",
  "dcterms:modified": "2026-05-25T15:38+09:00",
  "description": "Multiple vulnerabilities in Trend Micro Endpoint security products for enterprises contain multiple vulnerabilities listed below.\u003cul\u003e\u003cli\u003eRelative path traversal in Apex One server (CWE-23) - CVE-2026-34926\u003cul\u003e\u003cli\u003eThe only product that could be vulnerable to this exploit is TrendAI Apex One (On Premise).\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eOrigin validation error in Security Agent (CWE-346) - CVE-2026-34927,CVE-2026-34928,CVE-2026-34929,CVE-2026-34930,CVE-2026-45206,CVE-2026-45207\u003c/li\u003e\u003cli\u003eTime-of-check time-of-use (TOCTOU) race condition in Security Agent (CWE-367) - CVE-2026-45208\u003c/li\u003e\u003c/ul\u003eTrend Micro Incorporated has reported that attacks exploiting CVE-2026-34926 have been observed in the wild.\r\n\r\nTrend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-016802.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:trendmicro:trendai_apex_one",
      "@product": "TrendAI Apex One",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:trendmicro:trendai_vision_one_endpoint_security-standard_endpoint_protection",
      "@product": "TrendAI Vision One Endpoint Security - Standard Endpoint Protection",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:trendmicro:trend_micro_apex_one",
      "@product": "Trend Micro Apex One",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "6.7",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-016802",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU90583059/index.html",
      "@id": "JVNVU#90583059",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-34926",
      "@id": "CVE-2026-34926",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-34927",
      "@id": "CVE-2026-34927",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-34928",
      "@id": "CVE-2026-34928",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-34929",
      "@id": "CVE-2026-34929",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-34930",
      "@id": "CVE-2026-34930",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-45206",
      "@id": "CVE-2026-45206",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-45207",
      "@id": "CVE-2026-45207",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-45208",
      "@id": "CVE-2026-45208",
      "@source": "CVE"
    },
    {
      "#text": "https://www.jpcert.or.jp/english/at/2026/at260014.html",
      "@id": "JPCERT-AT-2026-0014",
      "@source": "JPCERT AT"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/23.html",
      "@id": "CWE-23",
      "@title": "Relative Path Traversal(CWE-23)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/346.html",
      "@id": "CWE-346",
      "@title": "Origin Validation Error(CWE-346)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/367.html",
      "@id": "CWE-367",
      "@title": "Time-of-check Time-of-use (TOCTOU) Race Condition(CWE-367)"
    }
  ],
  "title": "Multiple vulnerabilities in Trend Micro Endpoint security products for enterprises (May 2026)"
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Trend Micro Apex One ist eine Endpoint-Security L\u00f6sung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann mehrere Schwachstellen in Trend Micro Apex One ausnutzen, um seine Privilegien zu erh\u00f6hen und beliebigen Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1643 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1643.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1643 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1643"
      },
      {
        "category": "external",
        "summary": "TrendMicro Security Bulletin vom 2026-05-21",
        "url": "https://success.trendmicro.com/en-US/solution/KA-0023430"
      }
    ],
    "source_lang": "en-US",
    "title": "Trend Micro Apex One: Mehrere Schwachstellen erm\u00f6glichen Privilegieneskalation und die Ausf\u00fchrung von Code",
    "tracking": {
      "current_release_date": "2026-05-28T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-29T07:10:45.015+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1643",
      "initial_release_date": "2026-05-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-05-28T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: ZDI-26-325, ZDI-26-324, ZDI-26-322, ZDI-26-321, ZDI-26-320, ZDI-26-323, ZDI-26-326"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cSP1 CP Build 18012",
                "product": {
                  "name": "Trend Micro Apex One \u003cSP1 CP Build 18012",
                  "product_id": "T054492"
                }
              },
              {
                "category": "product_version",
                "name": "SP1 CP Build 18012",
                "product": {
                  "name": "Trend Micro Apex One SP1 CP Build 18012",
                  "product_id": "T054492-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:trendmicro:apex_one:sp1_cp_build_18012"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cSP1 Build 17079",
                "product": {
                  "name": "Trend Micro Apex One \u003cSP1 Build 17079",
                  "product_id": "T054493"
                }
              },
              {
                "category": "product_version",
                "name": "SP1 Build 17079",
                "product": {
                  "name": "Trend Micro Apex One SP1 Build 17079",
                  "product_id": "T054493-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:trendmicro:apex_one:sp1_build_17079"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Service \u003cSecurity Agent build 14.0.20731",
                "product": {
                  "name": "Trend Micro Apex One Service \u003cSecurity Agent build 14.0.20731",
                  "product_id": "T054494"
                }
              },
              {
                "category": "product_version",
                "name": "Service Security Agent build 14.0.20731",
                "product": {
                  "name": "Trend Micro Apex One Service Security Agent build 14.0.20731",
                  "product_id": "T054494-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:trendmicro:apex_one:service__security_agent_build_14.0.20731"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Apex One"
          }
        ],
        "category": "vendor",
        "name": "Trend Micro"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-34927",
      "product_status": {
        "known_affected": [
          "T054494",
          "T054493",
          "T054492"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-34927"
    },
    {
      "cve": "CVE-2026-34928",
      "product_status": {
        "known_affected": [
          "T054494",
          "T054493",
          "T054492"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-34928"
    },
    {
      "cve": "CVE-2026-34929",
      "product_status": {
        "known_affected": [
          "T054494",
          "T054493",
          "T054492"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-34929"
    },
    {
      "cve": "CVE-2026-34930",
      "product_status": {
        "known_affected": [
          "T054494",
          "T054493",
          "T054492"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-34930"
    },
    {
      "cve": "CVE-2026-45206",
      "product_status": {
        "known_affected": [
          "T054494",
          "T054493",
          "T054492"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-45206"
    },
    {
      "cve": "CVE-2026-45207",
      "product_status": {
        "known_affected": [
          "T054494",
          "T054493",
          "T054492"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-45207"
    },
    {
      "cve": "CVE-2026-45208",
      "product_status": {
        "known_affected": [
          "T054494",
          "T054493",
          "T054492"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-45208"
    },
    {
      "cve": "CVE-2026-34926",
      "product_status": {
        "known_affected": [
          "T054493",
          "T054492"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-34926"
    }
  ]
}