Trend Micro Apex One & Vision One Multiple CVEs Patch Advisory

Vulnerability Overview Trend Micro has released updates addressing multiple vulnerabilities in its enterprise endpoint security products. Key vulnerabilities include: 1. Relative Path Traversal in Apex One Server (CVE-23) - CVSS Score: 4.9 (CVSS:3.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/SC:N/SE:H/SA:H) - CVSS Score: 6.7 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) - CVE-2026-34936 2. Raw Validation Error in Security Agent (CVE-346) - CVSS Score: 8.5 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SE:N/SA:N) - CVSS Score: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - CVE-2026-34927, CVE-2026-34928, CVE-2026-34929, CVE-2026-34930, CVE-2026-45206, CVE-2026-45207 3. Time-of-Check to Time-of-Use (TOCTOU) Race Condition in Security Agent (CVE-367) - CVSS Score: 8.5 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SE:N/SA:N) - CVSS Score: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - CVE-2026-45208 Affected Scope Apex One (On Premise) - Server: Build version earlier than 17079 - Security Agent: Build version earlier than 14.0.17079 Trend Micro Apex One as a Service - Server: Prior to the April 2026 maintenance update - Security Agent: Build version earlier than 14.0.20731 Trend Micro Vision One Endpoint Security - Standard Endpoint Protection - Server: Prior to the April 2026 maintenance update - Security Agent: Build version earlier than 14.0.20731 Remediation Apex One (On Premise) - Server: Service Pack 1 Critical Patch B10012 - Security Agent: Build version 14.0.18012 Trend Micro Apex One as a Service - Server: April 2026 maintenance update - Security Agent: Build version 14.0.20731 Trend Micro Vision One Endpoint Security - Standard Endpoint Protection - Server: April 2026 maintenance update - Security Agent: Build version 14.0.20731 Additional Information JPCERT/CC Vulnerability Analysis - Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC and notified users of the remediation via JVN. Update History - 2026/05/21: Updated the "Additional Information" section. Code Blocks No POC or exploit code is included on this page.

Goal Reached Thanks to every supporter — we hit 100%!

Trend Micro Apex One & Vision One Multiple CVEs Patch Advisory