Japanese cybersecurity software company Trend Micro has addressed an Apex One zero-day vulnerability exploited in attacks targeting Windows systems.
Apex One is Trend Micro’s enterprise-grade endpoint security platform that protects corporate networks from a wide range of security threats, including malware, ransomware, fileless attacks, and web-based threats.
Tracked as CVE-2026-34926, this directory traversal vulnerability in the Apex One (on-premises) server allows local attackers with admin privileges to inject malicious code.
“A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations,” Trend Micro saidon Thursday.
“This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.”
However, despite the restrictive requirements for successful exploitation, the company warned that “TrendAI has observed at least one attempt to exploit this vulnerability in the wild.”
Federal agencies ordered to patch within three weeks
Yesterday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also added CVE-2026-34926 to its list of actively exploited vulnerabilities and ordered federal agencies to patch their devices by June 4.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned. “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
On Thursday, Trend Micro also released security updates to address seven local privilege escalation vulnerabilities in the Apex One Standard Endpoint Protection (SEP) agent that attackers can exploit if they have permission to execute low-privileged code on the target system.
Threat actors have frequently targeted flaws in Trend Micro Apex One over the last several years, often in zero-day attacks.
For instance, Trend Micro warned of an actively exploited Apex One RCE bug (CVE-2025-54948) in August 2025 and addressed two other Apex One zero-days exploited in the wild in September 2022 (CVE-2022-40139) and September 2023 (CVE-2023-41179).
CISA currently tracks 12 Trend Micro Apex vulnerabilities that have either been or are still being abused in attacks.
Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.
This guide covers the 6 surfaces you actually need to validate.
