CVE-2022-26871

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 19,5%

Kerentanan Insufficient Verification of Data Authenticity pada trendmicro apex central, trendmicro apex one. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 31 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.

Rincian

Terbit di NVD

29 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

19,5% peluang dieksploitasi; lebih tinggi dari 97,3% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Trend Micro Apex Central Arbitrary File Upload Vulnerability

Masuk KEV

31 Maret 2022

Tenggat CISA

21 April 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://appweb.trendmicro.com/supportNews/NewsDetail.aspx?id=4435 advisory vendor
• https://success.trendmicro.com/jp/solution/000290660 mitigasi · patch · advisory vendor
• https://success.trendmicro.com/solution/000290678 mitigasi · patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26871 pemerintah AS
• https://jvn.jp/vu/JVNVU99107357 advisory pihak ketiga · vdb entry
• https://www.jpcert.or.jp/english/at/2022/at220008.html advisory pihak ketiga · vdb entry