CVE-2026-34926 Trend Micro Apex One (On-Premise) Directory Traversal

Exploited in the wild Medium 6.7 Published 21 May 2026 Updated 22 May 2026

A local attacker with administrative credentials can exploit a directory traversal flaw in the on-premise Apex One server to inject malicious code deployed to agents.

Exploited in the wild: Since 21 May 2026
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-34926?

CVE-2026-34926 is a medium-severity path traversal vulnerability in Trendmicro Apex One, published on 21 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.

This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

Weakness: CWE-23

Which versions are affected by CVE-2026-34926?

It affects 1 product.

Products include Trendmicro Apex One.

How do I fix CVE-2026-34926?

No fix has been published for CVE-2026-34926 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 4 Jun 2026.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-34926 being exploited?

Yes. Attackers have exploited CVE-2026-34926 in the wild since at least 21 May 2026.

Public exploit code: 1 proofs of concept on GitHub.

All Trendmicro Apex One vulnerabilities

Sources

Also known as GHSA-4ccp-cqrh-3w9v.