CVE-2026-34926

Katalog CVE

CVSS 6.7 · Medium KEV · sudah dieksploitasi EPSS 0,54%

Kerentanan Relative Path Traversal pada trendmicro apex one. Skor CVSS 3.1 6.7 (Medium) menurut trendmicro.com. Masuk katalog KEV CISA pada 21 Mei 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

Rincian

Terbit di NVD

21 Mei 2026

Terakhir diubah

23 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.7 (Medium), sumber trendmicro.com
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

Masuk KEV

21 Mei 2026

Tenggat CISA

4 Juni 2026 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://success.trendmicro.com/en-US/solution/KA-0023430 advisory vendor
• https://success.trendmicro.com/ja-JP/solution/KA-0022974 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926 advisory pihak ketiga · pemerintah AS
• https://jvn.jp/en/vu/JVNVU90583059/ advisory pihak ketiga
• https://www.jpcert.or.jp/english/at/2026/at260014.html advisory pihak ketiga