CVE-2022-26871: Trend Micro Apex Central unauthenticated arbitrary file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 pre-auth network-exploitable file upload leading to potential RCE, listed in CISA KEV with known exploitation and a high EPSS percentile.

What it is

Trend Micro Apex Central (and Apex One) contains an arbitrary file upload flaw caused by insufficient verification of data authenticity (CWE-345). An unauthenticated remote attacker can upload an arbitrary file, which the vendor and NVD state could lead to remote code execution. Because no authentication or user interaction is required and the impact is total loss of confidentiality, integrity and availability, this is a severe pre-auth flaw in a central management component.

Impact

An attacker gains the ability to place arbitrary files on the server and, per the description, potentially achieve remote code execution. Successful exploitation would give full control of the affected Apex Central host (CVSS 9.8, C/I/A all High).

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), per the CVSS vector. Any internet- or network-exposed Apex Central instance is a candidate target; the record does not specify the exact endpoint or port.

Exploitation

CVE-2022-26871 was added to CISA KEV on 2022-03-31 with a remediation due date of 2022-04-21, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.19633 (97.2nd percentile), and references carry Patch and Mitigation tags; KEV lists no known ransomware campaign use.

What to do

• Apply the vendor patches referenced in the Trend Micro advisories (success.trendmicro.com solutions 000290660 and 000290678) as the first action.
• If patching cannot be done immediately, apply the mitigations described in those same Trend Micro advisories.
• Remove Apex Central management interfaces from direct internet exposure; restrict access to trusted management networks or VPN.
• Audit the Apex Central host for unexpected or recently written files, especially in web-accessible directories.
• Monitor for and block upload attempts to Apex Central endpoints from untrusted sources at the network edge.

Detection

• Review Apex Central and web server logs for POST/multipart upload requests from unexpected source IPs, particularly those returning success without prior authentication.
• Alert on new or modified executable files (for example .jsp, .aspx, .php, .exe, .dll) appearing in Apex Central web or application directories.
• Monitor for child processes spawned by the Apex Central web service (IIS/w3wp or equivalent) that are unusual for normal operation.
• Hunt for outbound connections from the Apex Central host to unfamiliar destinations following upload activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.