CVE-2026-34926
MEDIUM severity · CVSS 6.7 · Path traversal · actively exploited (CISA KEV)
6.7CVSS MEDIUM exploited
Actively exploited in the wild (CISA Known Exploited Vulnerabilities).
Added to KEV 2026-05-21. US federal agencies must patch by 2026-06-04.
Summary
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
Impact & exploitability
Attack vectorLocal
Attack complexityHigh
Privileges requiredHigh
User interactionNone
Confidentiality impactHigh
Integrity impactLow
Availability impactLow
Exploit probability (EPSS)13%
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Affected products we track (1)
Recommendation
This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://success.trendmicro.com/en-US/solution/KA-0023430Advisory
- https://success.trendmicro.com/ja-JP/solution/KA-0022974Advisory
- https://jvn.jp/en/vu/JVNVU90583059/Advisory
- https://www.jpcert.or.jp/english/at/2026/at260014.htmlAdvisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926Advisory