NewsCompaniesFlawsGuides
Get the app
MediumFixedBeing used in attacksClosedUpdated

Trend Micro Apex One directory traversal CVE-2026-34926 used in attacks; fixes available

Attackers used a flaw in Trend Micro Apex One’s on-premise server to distribute malicious code to managed computers. They first need server administrator access. Ask IT to update the server and agents to the latest supported build.

What to do

If your workplace or family office uses Apex One, ask IT to update both the server and managed agents to the latest supported build for its language and deployment. Trend Micro specifies Critical Patch 18012 or later for existing Service Pack 1 installations; successfully installed build 17079 already fixes this vulnerability.

What’s happening

Trend Micro disclosed CVE-2026-34926 on 21 May after observing at least one exploitation attempt. The directory traversal flaw affects the on-premise Apex One server, which manages security software on an organisation’s computers. An attacker who already has local access and the server’s administrator credentials can alter an internal table to distribute malicious code to managed agents. Trend Micro explicitly requires those credentials to have been obtained elsewhere; this is not an unauthenticated internet file-reading flaw. CISA listed it as exploited the same day. Fixes are available: build 17079 addressed the vulnerability, but its Critical Patch installer was withdrawn over unrelated installation problems and replaced by 18012. Successfully installed 17079 systems remain protected against this flaw. Newer builds supersede those downloads. As at 3 November, the reviewed sources do not identify victims, an attacker or the scale of exploitation.

What
Flaw
Affects
Trend Micro Apex One 2019 on-premise server and managed Windows agents
Affected
Apex One 2019 (on-premise), Windows server and agent builds below 17079; Trend Micro states CVE-2026-34926 is exploitable only on the on-premise server.
Fixed in
Apex One 2019 SP1 build 17079, with agent build 14.0.0.17079: fixes the vulnerability; the Critical Patch download was withdrawn for unrelated installation problems.
Apex One 2019 SP1 Critical Patch build 18012: replacement for existing SP1 installations; subsequently superseded by newer builds.
Japanese Apex One 2019 SP1 Patch 5 build 20045: released 10 September 2026 and available as a newer cumulative update.
CVE
CVE-2026-34926
Since
21 May 2026
Closed
10 Sept 2026

Timeline

  1. New fixFixed

    Trend Micro released Japanese Service Pack 1 Patch 5 build 20045. Its download centre now marks 18012 as superseded, with its fixes included in newer builds.

  2. Vendor revised

    Trend Micro updated its Japanese patch notice with recovery advice for failed 17079 installations and instructions to install 18012. It also recommended 18012 for successfully patched systems to prevent later operational problems.

  3. CISA added

    CISA added CVE-2026-34926 to its Known Exploited Vulnerabilities catalogue, with a 4 June remediation deadline for US federal civilian agencies.

  4. Made public

    Trend Micro disclosed CVE-2026-34926 and confirmed at least one exploitation attempt. Exploitation requires local server access and administrator credentials obtained through another method.

  5. New fixFixed

    Trend Micro released Japanese Critical Patch 18012, the replacement identified in its security advisory for existing Service Pack 1 installations.

  6. Vendor revisedPartly fixed

    Trend Micro withdrew the Japanese Critical Patch 17079 after installation problems. The separate installer for new deployments was unaffected.

  7. New fixFixed

    Trend Micro released Japanese Apex One build 17079. Its subsequent security advisory identifies this build as containing the fix for CVE-2026-34926.

Sources

  1. ITW Security Bulletin: Apex One and Vision One – Standard Endpoint Protection May 2026Trend Micro · 21 May 2026
  2. Japanese security advisory: Multiple vulnerabilities in Apex One and Standard Endpoint Protection, May 2026Trend Micro · 22 May 2026
  3. Updated notice: Apex One 2019 Critical Patch build 17079Trend Micro · 2 June 2026
  4. Apex One 2019 Japanese software downloads and release historyTrend Micro · 10 Sept 2026
  5. Updated Alert Regarding Multiple Vulnerabilities in Trend Micro Products Including TrendAI Apex OneJPCERT/CC · 22 May 2026
  6. TrendAI Patches Apex One Zero-Day Exploited in the WildSecurityWeek · 22 May 2026
  7. Actively exploited Trend Micro Apex One flaw gets CISA warning (CVE-2026-34926)Help Net Security · 26 May 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from May 2026 · JSON · RSS