Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This…
Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.
Exploitation probability EPSS · FIRST
Exploitation signals 3 / 5
- KEV catalog (CISA)21 May 2026
- Exploited in EUVD (ENISA)21 May 2026
- Used by ransomwareno
- EPSS above 10 %13.4%
- No account, over the networkno
What to do
Fix
Apply the vendor’s fix as soon as it is available.
CISA guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Meanwhile
Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.
Manufacturers (CRA)
Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained
Description ENISA EUVD
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
Affected products
- 2019 (14.0) <14.0.0.17079
- SaaS <14.0.20731
Open source packages OSV
Affected libraries according to OSV, with fixed versions.
Timeline
-
Published
-
Exploitation reported (ENISA)
-
Added to the KEV catalog
-
CISA remediation due date
-
EPSS peak: 13.4%
References
Other exploited vulnerabilities from the same vendor
- CVE-2025-54948Trend Micro Apex One OS Command Injection Vulnerability6.9 · Background exploitation
- CVE-2023-41179Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability4.2 · Background exploitation
- CVE-2022-40139Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability4.2 · Background exploitation
- CVE-2022-26871Trend Micro Apex Central Arbitrary File Upload Vulnerability6.9 · Background exploitation
- CVE-2021-36742Trend Micro Multiple Products Improper Input Validation Vulnerability4.4 · Background exploitation
- CVE-2021-36741Trend Micro Multiple Products Improper Input Validation Vulnerability4.9 · Background exploitation