[KEV] CVE-2026-34926 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-34926 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-34926 is a directory traversal vulnerability in Trend Micro Apex One (on-premise) that allows a pre-authenticated local attacker to manipulate server-side configuration and push malicious code to managed endpoints.

Technical Detail

The flaw exists in the on-premise deployment of Trend Micro Apex One and permits a pre-authenticated attacker with local access to traverse directory boundaries and modify a key table on the Apex One server. By injecting malicious code into this table, the attacker can cause the server to distribute that code to all connected agents, effectively weaponizing the endpoint management infrastructure for lateral movement or payload delivery. The impact is significant given that Apex One agents typically operate with elevated privileges on managed hosts, making this a viable path to broad compromise across an enterprise environment.

Exploitation Status

CISA has confirmed active exploitation in the wild, adding this CVE to the Known Exploited Vulnerabilities catalog on May 21, 2026. The exploit maturity is rated Operational, meaning a reliable and functional exploit exists and is being used in real-world attacks, not merely demonstrated in a controlled research context.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. Given the nature of the vulnerability and the enterprise footprint of Apex One deployments, opportunistic and targeted actors with access to affected networks are both plausible. No specific sectors have been identified as primary targets in available reporting.

What To Do

Organizations running Trend Micro Apex One on-premise should apply the vendor-supplied patch immediately. Per CISA's Known Exploited Vulnerabilities catalog, federal agencies operating under BOD 22-01 are required to remediate this vulnerability by the deadline associated with the May 21, 2026 listing, which is typically 21 days from the date added. Administrators should audit Apex One server logs for unauthorized modifications to configuration tables and review agent deployment activity for unexpected or anomalous package distributions. If patching cannot be completed immediately, consider restricting local access to the Apex One server to the minimum necessary personnel and monitoring for directory traversal patterns in server-side logs until the patch is applied.