Trend Micro has patched a zero-day vulnerability in Apex One that was already being used in real attacks.
The flaw, tracked as CVE-2026-34926, affects the on-premises Apex One server. Attackers who already have admin access to the server could abuse it to push malicious code to protected devices.
CISA has added the bug to its actively exploited vulnerabilities list and ordered U.S. federal agencies to patch by June 4.
Trend Micro also fixed seven additional privilege escalation flaws in the Apex One agent.
Bottom line: organizations using Apex One on-prem should patch immediately.