CVE-2026-34926: Trend Micro Apex One Directory Traversal to Malicious Agent Deployment (KEV)

CVE-2026-34926 is a directory-traversal flaw in the on-premise Trend Micro Apex One management server that lets an attacker who has already obtained administrative credentials to that server modify a key database table and inject malicious code, which Apex One then pushes out to every managed endpoint agent — a server-compromise-to-mass-agent-compromise chain rather than an unauthenticated initial-access bug, and CISA's KEV catalog records at least one documented in-the-wild exploitation attempt.

CVE-2026-34926 is a directory-traversal vulnerability (CWE-23) in the on-premise edition of Trend Micro Apex One. NVD's description states: "A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations," adding that "this vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability" (NVD).

NVD lists only a Secondary CVSS v3.1 score from source [email protected]: base score 6.7 (medium), vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L — local attack vector, high attack complexity, high privileges required, scope changed. NVD's status is "Analyzed," but no NVD Primary CVSS metric is published, so this score is labelled not NVD-confirmed on this page. The low attack-vector/high-privilege values reflect that this bug escalates an already-compromised management server into mass code deployment, rather than granting initial unauthenticated access (NVD).

Trend Micro's own advisory bundles CVE-2026-34926 with seven related CVEs (CVE-2026-34927 through -34930 and CVE-2026-45206 through -45208) across CVSS 6.7-7.8, covering the same directory-traversal bug plus six origin-validation local-privilege-escalation flaws and one time-of-check/time-of-use issue. It states that most of the bundled issues require an attacker to "first obtain the ability to execute low-privileged code on the target system," while the directory-traversal variant specifically demands pre-existing administrative access to the server; the advisory also discloses "at least one instance of an attempt to actively exploit one of these vulnerabilities in the wild" and recommends immediate patching plus a review of remote-access controls and perimeter security policy (Trend Micro KA-0023430).

CISA added CVE-2026-34926 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-05-21, with a required-action due date of 2026-06-04; the catalog records known ransomware-campaign use as "Unknown." Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.1342 (96.412th percentile) — notably elevated for a medium-severity, privileged-access bug, consistent with its role as a reliable post-compromise escalation step rather than a direct internet-facing target (FIRST EPSS).

Organizations running on-premise Apex One should upgrade to SP1 CP build 18012 (or SP1 build 17079 on new installs) and should treat administrative access to the Apex One server itself as a high-value target to protect, since this flaw's real risk is what an attacker does after gaining that access: silently weaponizing the agent-update channel against every managed endpoint.

• Directory traversal (CWE-23) in the on-premise Trend Micro Apex One server lets a pre-authenticated attacker who already holds administrative server credentials modify a key table to inject malicious code deployed to managed agents; only exploitable on the on-premise edition. — NVD
• NVD lists only a Secondary CVSS v3.1 score of 6.7 (medium) from source [email protected], vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L; no NVD Primary metric is published, so the score is not NVD-confirmed. — NVD
• Trend Micro's bulletin bundles this CVE with seven related flaws across CVSS 6.7-7.8, discloses at least one documented in-the-wild exploitation attempt, and lists fixed builds (on-premise SP1 CP build 18012 / SP1 build 17079; SaaS agent 14.0.20731). — Trend Micro KA-0023430
• Added to the CISA KEV catalog on 2026-05-21, required-action due date 2026-06-04, known ransomware campaign use recorded as Unknown. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
• EPSS score is 0.1342 (96.412th percentile) as of 2026-10-28. — FIRST EPSS