CVE-2026-34926
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre...
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
- Record
CVE-2026-34926- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-23
- Updated
- 2026-11-02
EUVDEUVD-2026-31284
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
- Record
EUVD-2026-31284- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4ccp-cqrh-3w9v
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre...
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
- Record
GHSA-4ccp-cqrh-3w9v- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-23
- Updated
- 2026-11-02
CISA KEV No score
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
- Record
CVE-2026-34926- Weakness
- CWE-23
- Updated
- 2026-11-02
NVD
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
- Record
CVE-2026-34926- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-23
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | HORKimhab/CVE-2026-34926 | 2026-05-22 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34926 is a medium vulnerability (CVSS 6.7) in Trend Micro Apex One, published May 21, 2026. CISA lists it as known to be exploited, since May 21, 2026. EUVD reports exploitation since May 21, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.4%, the 96th percentile. No source names a fixed version.
References
success.trendmicro.com/en-US/solution/KA-0023430
jvn.jp/en/vu/JVNVU90583059
jpcert.or.jp/english/at/2026/at260014.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926
nvd.nist.gov/vuln/detail/CVE-2026-34926
github.com/advisories/GHSA-4ccp-cqrh-3w9v