Trend Micro Apex One/SEP Multiple Vulnerabilities Security Bulletin (CVE-2026-34926/34927/34928)

ITW Security Bulletin: Apex One and Vision One - Standard Endpoint Protection (SEP) May 2026 Security Bulletin Vulnerability Overview TrendAI has released updates for Apex One (on-premise), Apex One as a Service, and Endpoint Protection (SEP) to address multiple vulnerabilities. Release Date: May 21, 2026 Severity Rating: MEDIUM - HIGH Threat Intelligence: TrendAI has observed at least one attempt to exploit these vulnerabilities in the wild. Affected Scope Apex One (On-prem): 2019 (On-prem) Apex One as a Service: SaaS TrendAI Vision One Endpoint Security - Standard Endpoint Protection (SEP): Agent builds below 14.0.20731 Platform: Windows Language: English Solution TrendAI has released the following solutions: Note: While the vulnerability was initially resolved in CP 17079, the Critical Patch update for existing SP1 users was removed due to an unrelated issue and replaced with CP 18012. Users who have already applied the previous CP 17079 version or installed the fresh 17079 build are already protected. Vulnerability Details CVE-2026-34926: Apex One Server Directory Traversal Vulnerability CVSSv3.1: 6.7: AV:L/AC:L/PR:N/UI:N/S:C/C:H/L Weakness: CWE-23 Description: A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify the key table on the server to inject malicious code into agents within the affected installation. Exploit Conditions: This vulnerability is only exploitable on the on-premise version of Apex One. A potential attacker must have access to the Apex One server and have already obtained administrative credentials for the server through other means. Threat Intelligence: Please be aware - TrendAI has observed at least one attempt to exploit this vulnerability in the wild. CVE-2026-34927: Security Agent Origin Validation Error Local Privilege Vulnerability ZDI-CAN-27959 CVSSv3.1: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Weakness: CWE-346 Description: An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges within the affected installation. Exploit Conditions: Please note: An attacker must first gain the ability to execute low-privileged code on the target system to exploit this vulnerability. CVE-2026-34928: Security Agent Origin Validation Error Local Privilege Vulnerability ZDI-CAN-28061 CVSSv3.1: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Weakness: CWE-346 Description: An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges within the affected installation. This is similar to CVE-2026-34927 but exists in a different named pipe communication mechanism. Exploit Conditions: Please note: An attacker must first gain the ability to execute low-privileged code on the target system to exploit this vulnerability. CVE-2026-34929: Security Agent Origin Validation Error Local Privilege Vulnerability ZDI-CAN-28077 CVSSv3.1: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Weakness: CWE-346 Description: An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges within the affected installation. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism. Exploit Conditions: Please note: An attacker must first gain the ability to execute low-privileged code on the target system to exploit this vulnerability. CVE-2026-34930: Security Agent Origin Validation Error Local Privilege Vulnerability ZDI-CAN-28089 CVSSv3.1: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Weakness: CWE-346 Description: An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges within the affected installation. This is similar to CVE-2026-34927 but exists in a different process protection mechanism. Exploit Conditions: Please note: An attacker must first gain the ability to execute low-privileged code on the target system to exploit this vulnerability. CVE-2026-45206: Security Agent Origin Validation Error Local Privilege Vulnerability ZDI-CAN-28118 CVSSv3.1: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Weakness: CWE-346 Description: An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges within the affected installation. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism. Exploit Conditions: Please note: An attacker must first gain the ability to execute low-privileged code on the target system to exploit this vulnerability. CVE-2026-45207: Security Agent Origin Validation Error Local Privilege Vulnerability ZDI-CAN-29177 CVSSv3.1: 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Weakness: CWE-346 Description: An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges within the affected installation. This is similar to CVE-2026-45206 but exists in a different process protection

Goal Reached Thanks to every supporter — we hit 100%!

Trend Micro Apex One/SEP Multiple Vulnerabilities Security Bulletin (CVE-2026-34926/34927/34928)