Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2022-26871

CVE-2022-26871CRITICAL

Trend Micro Apex Central

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .1948   97.3   YES

AFFECTED
  Product                   Versions                   Fixed
  Trend Micro Apex Central  2019 (on-premise), SaaS –  —

TIMELINE
  Mar 10  Reserved by trendmicro
  Mar 29  Published (CNA: trendmicro)
  Mar 31  Added to CISA KEV, remediation due 2022-04-21

CWE-345 · CNA: trendmicro · CVSS v3.1 · 6 references · KEV due April 21, 2022

Description

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
March 10, 2022	Reserved	Reserved by trendmicro
March 29, 2022	Published	Published (CNA: trendmicro)
March 31, 2022	KEV ADDED	Added to CISA KEV, remediation due 2022-04-21

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Trend Micro	Trend Micro Apex Central	—	2019 (on-premise), SaaS	—

Weaknesses

CWE-345

References (6)

https://appweb.trendmicro.com/supportNews/NewsDetail.aspx?id=4435 [x_refsource_MISC]
https://jvn.jp/vu/JVNVU99107357 [x_refsource_MISC]
https://success.trendmicro.com/jp/solution/000290660 [x_refsource_MISC]
https://success.trendmicro.com/solution/000290678 [x_refsource_MISC]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26871 [government-resource]
https://www.jpcert.or.jp/english/at/2022/at220008.html [x_refsource_MISC]

Authoritative record: CVE-2022-26871 at cve.org

Vendors: trend micro

Weaknesses: CWE-345

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-26871 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.