CVE-2026-34926 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-34926MEDIUM

Trend Micro Apex One

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   H   H   N  C  H  L  L    6.7   .1268   95.9   YES

AFFECTED
  Product                        Versions       Fixed
  TrendAI Apex One               2019 (14.0) –  —
  TrendAI Apex One as a Service  SaaS –         —

TIMELINE
  Mar 31  Reserved by trendmicro
  May 21  Added to CISA KEV, remediation due 2026-06-04
  May 21  Published (CNA: trendmicro)
  Jun 5   DUE DATE PASSED — CVE-2026-34926 (Trend Micro, Inc. TrendAI Apex One). CISA remediation deadline was June 4, 2026; still in catalog.
  Jul 23  ENRICHED — CVE-2026-34926 (Trend Micro Apex One). Received CVSS 6.7 and CPE data from NVD.

CWE-23 · CNA: trendmicro · CVSS v3.1 · 5 references · NVD status: Analyzed · KEV due June 4, 2026

Description

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

Lifecycle

Complete event history — 5 events, chronological
Date	Event	Detail
March 31, 2026	Reserved	Reserved by trendmicro
May 21, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-06-04
May 21, 2026	Published	Published (CNA: trendmicro)
June 5, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-34926 (Trend Micro, Inc. TrendAI Apex One). CISA remediation deadline was June 4, 2026; still in catalog.
July 23, 2026	ENRICHED	ENRICHED — CVE-2026-34926 (Trend Micro Apex One). Received CVSS 6.7 and CPE data from NVD.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Trend Micro, Inc.	TrendAI Apex One	—	2019 (14.0)	—
Trend Micro, Inc.	TrendAI Apex One as a Service	—	SaaS	—

Weaknesses

CWE-23

References (5)

https://jvn.jp/en/vu/JVNVU90583059/ [Third Party Advisory]
https://success.trendmicro.com/en-US/solution/KA-0023430 [Vendor Advisory]
https://success.trendmicro.com/ja-JP/solution/KA-0022974 [Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926 [Third Party Advisory, US Government Resource]
https://www.jpcert.or.jp/english/at/2026/at260014.html [Third Party Advisory]

Authoritative record: CVE-2026-34926 at cve.org

Vendors: trend micro

Weaknesses: CWE-23

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-34926 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.