CVE-2026-34926: Trend Micro Apex One on-premise server directory traversal enables agent code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA KEV with a near-term remediation deadline and a high EPSS percentile, though exploitation requires pre-existing server admin credentials and local access.

What it is

A relative path traversal (CWE-23) in the Apex One on-premise server lets an attacker who already holds administrative credentials on the server modify a key table and inject malicious code that is then deployed to managed agents. Only the on-premise deployment is affected. Because the injected code reaches every agent the server manages, a single compromised server can push malicious payloads across the whole managed endpoint fleet.

Impact

An attacker with server admin access can tamper with the key table and distribute malicious code to all managed agents, giving control over endpoint protection across the estate. The scope change in the CVSS vector reflects that the compromise of the server extends to the agents it manages.

Attack surface

Reached locally on the Apex One on-premise server (AV:L) and requires high privileges (PR:H), meaning the attacker must already have administrative credentials obtained by other means; no user interaction is needed (UI:N). The flaw is not present in the SaaS/cloud version.

Exploitation

The vulnerability is listed in CISA KEV with a remediation due date of 2026-06-04, indicating known exploitation, and EPSS gives a 30-day probability of 0.12682 (96th percentile). No ransomware campaign use is documented.

What to do

• Apply the Trend Micro vendor fix referenced in KA-0023430 (and the Japanese advisory KA-0022974) as the first action.
• If patching is not immediately possible, follow CISA BOD 22-01 guidance or discontinue use of the on-premise Apex One server until mitigations are in place.
• Restrict and audit administrative access to the Apex One server, since exploitation requires pre-existing admin credentials.
• Review the server's key table and agent deployment configuration for unauthorized modifications.
• Monitor managed agents for unexpected code or policy pushes originating from the server.

Detection

• Audit Apex One server logs for unexpected changes to the key table or agent deployment configuration.
• Alert on anomalous or out-of-band code/policy pushes to managed agents.
• Correlate server-side file access events with traversal-style relative paths.
• Review administrative account activity on the Apex One server for credential misuse or unusual logon patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.