Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🛡️
CISA KEV · ACTIVELY EXPLOITED
MEDIUM severity

CVE-2026-34926 — Apexone Op

MEDIUM

CVE-2026-34926 is a medium-severity (CVSS 6.7) CWE-23 vulnerability in trendmicro apexone op. It is in CISA's Known Exploited Vulnerabilities catalog (added 2026-05-21) — treat it as actively exploited and patch now. No vendor fix is recorded yet; mitigation options are listed below.

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to…

Published
Updated
Affected
2 products
Patched
See advisory
Exploits
None indexed
Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2026-05-21. Federal agencies were required to remediate by 2026-06-04.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2026-34926.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk-12.14%
Lower risk than most CVEs45th percentile — riskier than 45% of all scored CVEsHighest risk
0.00%5.44%10.9%16.3%1.0%12.7%12.7%0.5%Jun 26Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-34926 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Description

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.

This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

Affected Products

2 products · 2 configurations
Application
apexone optrendmicro
1 version
14.0.0.17079
Application
apexone saastrendmicro
1 version
14.0.0.20731

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every trendmicro apexone op deployment and check each version against the affected-products list above.

  2. Remediation status

    No patch has shipped for CVE-2026-34926 yet — track the trendmicro apexone op advisory for a fixed release and apply the workarounds below in the meantime.

  3. Mitigate without a patch

    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
O3 Security · Runtime Protection

Is CVE-2026-34926 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
CVE-2026-34926: Apexone Op Path Traversal (KEV)