CVE-2026-34926: Apex One server path traversal can push malicious code to agents

What it is

The Apex One on-premise server has a relative path traversal bug (CWE-23). An attacker who already has administrator credentials for the server can use it to modify a key table on the server. That lets them inject malicious code and have the server deploy it to the Apex One agents on your endpoints.

The CVSS score is only 6.7 (medium) because it needs administrator access first. Don’t read that as low risk. The server is the management point for every endpoint agent, so an attacker who is already on it can turn the server into a distribution channel. Trend Micro says it has seen at least one exploitation attempt in the wild, and CISA lists the CVE as exploited. CISA has not reported ransomware use.

The same bulletin fixes seven agent privilege escalation bugs (CVE-2026-34927 to CVE-2026-34930 and CVE-2026-45206 to CVE-2026-45208). Those need local code execution on the endpoint and were not reported as exploited. You get their fixes in the same builds.

Am I affected?

You are affected if you run Apex One 2019 (on-premise) with server or agent builds below 17079. Only the on-premise server is exploitable for this CVE.

• Apex One as a Service / Vision One Endpoint Security: not exploitable for this CVE. Trend Micro’s CVE record marks the on-premise server only. JVN says the SaaS servers were fixed in the April 2026 maintenance. SaaS Security Agents below 14.0.20731 are still affected by the other agent bugs in the bulletin.
• Exploitation needs administrator credentials to the Apex One server, so exposure is highest where the console or server host is reachable from user networks or the internet, or where admin accounts are shared or weakly protected.

Check your server and agent build in the Apex One console, and compare it with the table above. Trend Micro’s bulletin does not give a menu path, so use its product documentation.

What to do

1. Patch the server and the agents. Existing SP1 installs should apply Critical Patch build 18012. New installs should use SP1 build 17079 or later. Trend Micro removed the original CP 17079 for existing SP1 users because of an unrelated issue and replaced it with CP 18012. Customers who already applied CP 17079 or installed a fresh 17079 build are already protected. Trend Micro recommends the latest available build.
2. Restrict access to the Apex One server. Trend Micro’s bulletin advises reviewing remote access to critical systems and keeping policies and perimeter security current. Limit who can reach the server and console, and protect admin accounts with strong, unique credentials and MFA where your setup supports it.
3. No workaround exists. JVN lists none. Patch.
4. If the server was reachable by an untrusted party before patching, treat it as possibly compromised. Review who held administrator access, rotate Apex One admin credentials, and check what the server pushed to agents (see Detection).

CISA’s required action is to apply the vendor’s mitigations or stop using the product. The federal due date was June 4, 2026.

Detection

No indicators of compromise (IPs, hashes, file names) have been published by Trend Micro, JPCERT/CC, JVN or CISA. Check the vendor’s bulletin and ZDI advisories again for updates.

Look for evidence of abuse of administrator access and of tampering with what the server deploys:

• Unexpected administrator logins to the Apex One server or console, especially from unusual hosts or at odd hours.
• Unexpected changes to server-side configuration, or to the files the server distributes to agents.
• Agents downloading or running updates, components or programs you did not schedule.
• Unusual processes launched by the Apex One agent service across many endpoints at around the same time.

Because the impact is code running on endpoints through the agent, an endpoint-wide hunt matters more than a single log search if you suspect compromise.