DaystoPatch

Trend MicroExploited incident

Trend Micro Apex One (on-prem) server directory traversal, fixed before public disclosure (CVE-2026-34926)

CVE-2026-34926Medium, CVSS 6.7In CISA's Known Exploited Vulnerabilities catalog since 21 May 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    TrendAI CSAF advisory 2026-0521-TM-A1-001CuratedQuote verified

    "initial_release_date" : "2026-05-21T13:00:00.000Z"

    The bulletin was the first public information about the bug; the fixing build had shipped on 2026-03-26 without naming it.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e3f3789ce9f66bfe…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CISA KEV (CVE-2026-34926)ClaimedQuote verified21 May 2026

    Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

    Added to CISA's KEV catalog on 2026-05-21.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet21 May 2026, 07:36 UTC

    「開発者によると、CVE-2026-34926を悪用する攻撃が既に確認されているとのことです。」

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Trend Micro advisory 2026-0521-TM-A1-001ClaimedQuote verified21 May 2026, 13:00 UTC

    ITW SECURITY BULLETIN: Apex One and Vision One and Standard Endpoint Protection (SEP) May 2026 Security Bulletin

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e3f3789ce9f66bfe…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-34926ClaimedQuote verified21 May 2026, 13:03 UTC

    A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f91d0af3b7cd219d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet21 May 2026, 22:00 UTC

    🚨 [CISA-2026:0521] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:0521 ) CISA has added 2 new vulnerabilities to its Known

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Trend Micro advisory 2026-0521-TM-A1-001ClaimedQuote verified

    ITW SECURITY BULLETIN: Apex One and Vision One and Standard Endpoint Protection (SEP) May 2026 Security Bulletin

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e3f3789ce9f66bfe…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    TrendAI CSAF advisory 2026-0521-TM-A1-001CuratedQuote verified21 May 2026, 13:00 UTC

    "initial_release_date" : "2026-05-21T13:00:00.000Z"

    Machine-readable release time of the bulletin (UTC). The HTML bulletin KA-0023430 shows 'Release Date: May 21, 2026'.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e3f3789ce9f66bfe…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Born City (Günter Born), 2026-03-26CuratedQuote verified

    Trend Micro hat zum 26. März 2026 sowohl sein Trend Micro Apex One™ Service Pack 1 (2025) veröffentlicht, als auch den kritischen Patch Build 17079 freigegeben.

    Independent dated report that build 17079 (SP1 2025 installer and Critical Patch) was released on 2026-03-26.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3205c2d16d0df9ba…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Trend Micro KB KA-0022891: Apex One Service Pack 1 (2025) & Critical Patch build 17079CuratedQuote verified26 Mar 2026

    Last updated: 2026/03/26

    KB announcing 'Trend Micro Apex One™ Service Pack 1 (2025) & Critical Patch build 17079 is now available' ('Last updated' is the only date shown). The May 2026 bulletin says 'the vulnerabilities were originally addressed in the CP 17079 build'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:71a154fd08d7580c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Trend Micro advisory 2026-0521-TM-A1-001ClaimedQuote not found in archive21 May 2026, 13:00 UTC

    Update to SP1 CP Build 17079 or later

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:4e7d2bde59d6c349…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Trend Micro KB KA-0022891: Apex One Service Pack 1 (2025) & Critical Patch build 17079CuratedQuote verified

    Last updated: 2026/03/26

    Build 17079 shipped both as a fresh-install package and as a Critical Patch for existing installations, which covers the only affected product (Apex One 2019 on-prem). Caveat: KA-0023430 says the Critical Patch for existing SP1 users 'was removed due to an unrelated issue and replaced with the CP 18012 version' (CP 18012 listed as 'Now Available' on 2026-05-21; its own release date was not found); users who had applied CP 17079 were already protected.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:71a154fd08d7580c…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Trend Micro Apex One 2019 (on-premise) server, builds below 17079
How we built this timeline

Silent fix: build 17079 (26 Mar 2026) fixed the bug about eight weeks before TrendAI's bulletin (21 May 2026) disclosed it, together with seven agent privilege-escalation CVEs (CVE-2026-34927..34930, CVE-2026-45206..45208; those are not in KEV and are not part of this incident). The bulletin says 'TrendAI has observed at least one attempt to exploit this vulnerability in the wild (ITW)!' but gives no date, so it is unknown whether exploitation began before 26 Mar 2026. exploited before a fix=true (audit-2 T2 re-check, 23 Oct 2026; was false after the first correction pass and null before it).

The bulletin's acknowledgement credits 'TrendAI Incident Response (IR) Team (CVE-2026-34926)', and Uganda's national CERT (26 May 2026) says the flaw was 'discovered by Trend Micro's own incident response team during investigation of real-world activity'. The bulletin says the bug was 'originally addressed in the CP 17079 build' (26 Mar 2026).

Discovery during an incident investigation must precede that fix, so the in-the-wild activity predated the first fix, although it was made public only on 21 May 2026. Exposure stays zero, because nothing was public before the fix.

Field Effect says Trend observed an attempt 'prior to disclosure'; Secra calls it 'exploited in zero-day attacks before the official patch', treating the May bulletin as the patch.

Neither gives an independent date. Searched: Trend's bulletin and CSAF, news (BleepingComputer, Help Net Security, SecurityWeek), Field Effect, Secra, cert.ug, Hive Pro and CVE aggregators.

No Trend research post-mortem was found. Exploitation requires existing administrative credentials on the Apex One server.

Only the on-premise server is affected; the SaaS agent build 14.0.20731 in the bulletin addresses the agent CVEs. CVSS 6.7 from TrendAI.

KEV added 21 May 2026, the same day as the bulletin.

Related

No related incidents.

Trend Micro report card