Loading story…
JPCERT/CC warned that multiple vulnerabilities in TrendAI Apex One, Trend Micro Apex One as a Service, and TrendAI Vision One Endpoint Security - Standard Endpoint Protection could let attackers distribute crafted code to security agents or gain elevated privileges. Trend Micro said cloud-side fixes for the hosted products were applied during maintenance in April 2026, but endpoint agents still need to be updated to fully remediate the issue.
The most urgent flaw is the on-premises relative path traversal vulnerability CVE-2026-34926, which Trend Micro confirmed is already being exploited in attacks. JPCERT/CC urged organizations using the on-premises version of TrendAI Apex One to patch immediately, while customers of the cloud-based offerings should also update affected agents to close the remaining exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-21, JPCERT/CC published advisory JPCERT-AT-2026-0014 covering multiple vulnerabilities in TrendAI Apex One, Apex One as a Service, and TrendAI Vision One Endpoint Security, and urged prompt patching.
Trend Micro confirmed that attackers were exploiting CVE-2026-34926, a relative path traversal vulnerability in the on-premises version of TrendAI Apex One, which could help distribute crafted code or enable privilege escalation.
Users were advised to update to the latest vendor-published versions of WPS Office2, WPS Cloud, WPS Cloud Pro, and KINGSOFT PDF Pro to remediate CVE-2018-6400.
LAC reported the WPS named-pipe access control flaw to IPA, and JPCERT/CC coordinated with the developer under Japan's Information Security Early Warning Partnership.
Trend Micro stated that server-side fixes for affected cloud-based products were applied during maintenance in April 2026, though endpoint security agents still required patching.
A local privilege escalation vulnerability later tracked as CVE-2018-6400 was originally reported around 2018, affecting a background service in WPS-related products that used a named pipe with insufficient access controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro issued security updates for **Apex One** and related endpoint protection offerings to fix eight vulnerabilities, including two critical path traversal flaws in the Apex One management console tracked as `CVE-2025-71210` and `CVE-2025-71211`. According to the vendor bulletin and CSIRT.SK, the bugs affect **Apex One 2019 on-premises for Windows**, **Apex One SaaS for Windows**, **Trend Vision One Endpoint – Standard Endpoint Protection SaaS for Windows**, and **Apex One SaaS for Mac**, and could allow an unprivileged attacker with access to the console to upload and execute malicious code. The same update also addresses six local privilege escalation issues, `CVE-2025-71212` through `CVE-2025-71217`, impacting scanning components and Mac agent services or mechanisms. Organizations were urged to apply **Critical Patch Build 14136** for on-premises deployments and **Security Agent Build 14.0.20315** for SaaS deployments immediately, while taking additional precautions if management consoles are exposed to the public internet.
Jul 24, 2026
CISA added **`CVE-2026-34926`** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical **Trend Micro Apex One** on-premise flaw. The vulnerability is a directory traversal issue that can be abused by a pre-authenticated local attacker to manipulate file paths, access restricted directories, alter a key database table, and inject malicious code that may then be pushed to connected endpoint agents. Because Apex One centrally manages endpoint protection, a successful compromise could weaken EDR visibility and turn the management server into a distribution point for enterprise-wide malware. Trend Micro issued advisories covering multiple vulnerabilities across **Apex One (on-premise)**, **Apex One as a Service**, and **Trend Vision One Endpoint / Standard Endpoint Protection**, with affected builds including Apex One server and agent versions prior to **2019 build 17079** and SEP agent versions prior to **14.0.20731**. National cyber authorities in Canada, Germany, and Hong Kong circulated related alerts, while CISA directed U.S. federal agencies to remediate the exploited flaw by **June 4, 2026** and urged organizations to apply vendor updates, restrict local access to Apex One servers, and increase monitoring for signs of compromise.
Jun 29, 2026
**Trend Micro patched two critical remote code execution vulnerabilities in *Apex One* affecting Windows environments**, both caused by **path traversal weaknesses in the Apex One management console**: `CVE-2025-71210` and `CVE-2025-71211`. Trend Micro stated exploitation requires an attacker to have access to the management console, and warned organizations with consoles exposed to the internet to apply mitigations such as source/IP restrictions and to update to the latest builds; the fixes include updates for SaaS deployments and **Critical Patch Build 14136** for affected on-prem installations. Canada’s Centre for Cyber Security issued advisory **AV26-168** urging administrators to apply Trend Micro’s updates for **Apex One (on-premise)**, **Apex One as a Service (SaaS)**, and **Trend Vision One Endpoint / Standard Endpoint Protection (SaaS)**. Neither advisory indicated confirmed exploitation in the wild for these specific CVEs at the time of publication, but the vendor and reporting highlighted that **Apex One vulnerabilities have been actively exploited in prior campaigns**, reinforcing the need for rapid patching and exposure reduction of management interfaces.
Jun 29, 2026