CISA Warns Trend Micro Apex One Vulnerability Is Being Exploited in Attacks

CISA has added a newly disclosed vulnerability in Trend Micro Apex One to its Known Exploited Vulnerabilities (KEV) catalog, warning that the flaw is actively being exploited in real-world attacks.

The issue, tracked as CVE-2026-34926, affects on-premise deployments of Trend Micro Apex One and poses a significant risk to enterprise environments.

The vulnerability is classified as a directory traversal flaw (CWE-23) that allows a pre-authenticated local attacker to manipulate server-side files.

Specifically, the flaw enables attackers to modify a critical key table within the Apex One server. By exploiting this weakness, threat actors can inject malicious code that is subsequently distributed to connected endpoint agents, effectively turning the security platform into a delivery mechanism for malware.

According to CISA, the vulnerability was added to the KEV catalog on May 21, 2026, highlighting confirmed evidence of active exploitation.

While there are currently no public reports directly linking the flaw to ransomware campaigns , the potential for large-scale compromise makes it particularly dangerous. Attackers leveraging this vulnerability could gain widespread access across enterprise networks by abusing trusted update mechanisms.

Trend Micro Apex One is widely used for endpoint protection, making it a high-value target for adversaries. The ability to inject malicious payloads into agents managed by the platform significantly amplifies the impact of exploitation, potentially leading to full network compromise, data exfiltration, or lateral movement.

CISA has issued a directive requiring federal agencies to remediate the vulnerability by June 4, 2026. The agency strongly urges organizations to immediately follow vendor-provided mitigation guidance. If patches or mitigations are unavailable, organizations are advised to consider discontinuing the use of affected systems until the risk is addressed.

Security teams should prioritize the following actions:

Given the nature of the vulnerability, organizations should also conduct threat hunting activities to identify potential indicators of compromise (IOCs). Although specific IOCs have not yet been widely published, abnormal agent behavior or unexpected updates may signal exploitation attempts.

The inclusion of CVE-2026-34926 in CISA’s KEV catalog underscores the urgency of remediation. As attackers continue to target security infrastructure itself, vulnerabilities like this highlight the importance of securing management systems that have broad control over enterprise endpoints.

Organizations using Trend Micro Apex One on-premise deployments should treat this vulnerability as critical and take immediate steps to mitigate risk before exploitation leads to widespread compromise.

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Russian state- and aligned threat groups are increasingly combining Remote Desktop Protocol (RDP), Virtual Private…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Langflow vulnerability, tracked…

Hackers compromised the popular art-template npm package to inject a stealthy backdoor that redirected users’…

Hackers are actively exploiting FreePBX systems using a highly resilient six-layer persistence mechanism. The campaign…

CISA has issued an urgent alert warning organizations two newly disclosed zero-day vulnerabilities affecting…

Hackers are actively using Brazil’s electronic invoice system (NF-e) as a lure to distribute a…