CVE-2026-34926

Confirmed PUBLISHED

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the...

Trend Micro, Inc. · TrendAI Apex One, TrendAI Apex One as a Service

1 day faster than CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

6.7 Medium EPSS 12.7%

At a Glance

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

cisa

CVE Published: May 21, 2026
Exploitation Reported: Jun 01, 2026
CVSS: 6.7 Medium
EPSS: 12.7%

No user interaction

Affected Versions

Vendor	Product	Version	Status
Trend Micro, Inc.	TrendAI Apex One	2019 (14.0) to < 14.0.0.17079	Affected
Trend Micro, Inc.	TrendAI Apex One as a Service	SaaS to < 14.0.20731	Affected

CVE References

success.trendmicro.com/en-US/solution/KA-0023430 success.trendmicro.com · CVE Record https://success.trendmicro.com/en-US/solution/KA-0023430
success.trendmicro.com/ja-JP/solution/KA-0022974 success.trendmicro.com · CVE Record https://success.trendmicro.com/ja-JP/solution/KA-0022974
jvn.jp/en/vu/JVNVU90583059 jvn.jp · CVE Record https://jvn.jp/en/vu/JVNVU90583059/
jpcert.or.jp/english/at/2026/at260014.html jpcert.or.jp · CVE Record https://www.jpcert.or.jp/english/at/2026/at260014.html

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CVE First	2026-06-01 13:29 UTC
CISA	2026-06-02 14:00 UTC

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2026-34926

{
  "cve_id": "CVE-2026-34926",
  "title": "A directory traversal vulnerability in the Apex One (on-premise) server could...",
  "affected_vendor": "Trend Micro, Inc.",
  "affected_product": "TrendAI Apex One, TrendAI Apex One as a Service",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 6.7,
  "epss_score": 0.12682,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2026-34926

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API