Apex One and Apex Central
CVE-2022-40139: Apex One and Apex One as a Service Improper Validation
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Trend Micro Apex One 2019 (on-prem) and SaaS | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.
Exploitation
CISA lists this CVE as exploited in the wild since 15 Sept 2022.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.