CVE-2022-40139 Trend Micro Apex One and Apex One as a Service Improper Validation
A server administrator can instruct clients to download unverified rollback packages, leading to remote code execution on the client.
- Exploited in the wild
- Since 15 Sep 2022
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-40139?
CVE-2022-40139 is a high-severity code injection vulnerability in Trendmicro Apex One, published on 19 Sep 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.
Which versions are affected by CVE-2022-40139?
It affects 1 product.
Products include Trendmicro Apex One.
How do I fix CVE-2022-40139?
No fix has been published for CVE-2022-40139 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 6 Oct 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-40139 being exploited?
Yes. Attackers have exploited CVE-2022-40139 in the wild since at least 15 Sep 2022.
Other vulnerabilities in Trendmicro Apex One
- CVE-2020-8599 Trend Micro Apex One and OfficeScan Authentication Bypass
- CVE-2025-54948 Trend Micro Apex One OS Command Injection
- CVE-2021-36741 Trend Micro Multiple Products Improper Input Validation
- CVE-2020-8467 Trend Micro Apex One and OfficeScan Remote Code Execution
- CVE-2020-8468 Trend Micro Multiple Products Content Validation Escape
Sources
Also known as GHSA-6h63-j29f-rv95.