Security News Trend Micro warns of Apex One zero-day exploited in the wild

[Brownie2019]

Content source

https://www.bleepingcomputer.com/news/security/trend-micro-warns-of-apex-one-zero-day-exploited-in-attacks/

Japanese cybersecurity software company Trend Micro has addressed an Apex One zero-day vulnerability exploited in attacks targeting Windows systems.

Apex One is Trend Micro's enterprise-grade endpoint security platform that protects corporate networks from a wide range of security threats, including malware, ransomware, fileless attacks, and web-based threats.

Tracked as CVE-2026-34926, this directory traversal vulnerability in the Apex One (on-premises) server allows local attackers with admin privileges to inject malicious code.

"A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations," Trend Micro saidon Thursday.

"This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability."

However, despite the restrictive requirements for successful exploitation, the company warned that "TrendAI has observed at least one attempt to exploit this vulnerability in the wild."

Read more on:

Trend Micro warns of Apex One zero-day exploited in the wild

Japanese cybersecurity software company Trend Micro has addressed an Apex One zero-day vulnerability exploited in attacks targeting Windows systems.

www.bleepingcomputer.com

 

[Bot]

Read more on:

Trend Micro warns of Apex One zero-day exploited in the wild

Japanese cybersecurity software company Trend Micro has addressed an Apex One zero-day vulnerability exploited in attacks targeting Windows systems.

www.bleepingcomputer.com

This is a serious issue, but the scope is narrower than a typical remote zero-day.

What matters here

• The affected product is Trend Micro Apex One (on-premises).
• The reported flaw is a directory traversal vulnerability tracked as CVE-2026-34926.
• Based on the quoted vendor description, exploitation appears to require local access to the Apex One server and [B>administrative credentials[/B] on that server.
• Trend Micro also said it has observed at least one in-the-wild exploitation attempt, which is why the advisory should be taken seriously.

Why this is important

Even though this does not sound like a simple remote unauthenticated compromise, Apex One is a security management platform with the ability to push content to protected endpoints.

If an attacker already has administrator-level access on the Apex One server, a flaw that helps them inject malicious code for deployment to agents could turn the management server into a distribution point inside the environment. In practice, that can increase the impact significantly.

Practical takeaway for admins

• Treat the Apex One server as a high-value asset and prioritize the vendor fix.
• Review Trend Micro’s official advisory and apply the recommended patches or mitigations as soon as possible.
• Restrict access to the Apex One server as much as possible, especially interactive logon and administrative access.
• Audit recent administrator activity on the server and check for unexpected configuration or policy changes.
• Review what was recently deployed from the Apex One console to endpoints, especially if anything unusual appeared.
• If compromise is suspected, involve your internal incident response process and preserve logs before making major changes.

Important nuance

The phrase "zero-day" can sound dramatic, but in this case the quoted information suggests the attacker already needs a strong foothold first. That does not make it harmless; it means this is more likely to be useful for post-compromise abuse rather than initial access.

Bottom line

For organizations running Apex One on-premises, this should be treated as a priority server-side security update, especially because exploitation has reportedly been observed in the wild.