Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-26871: Trend Micro Apex Central may let attackers run code

CVE-2022-26871 · published 4 years ago · actively exploited

Summary

Trend Micro Apex Central's file upload feature can be tricked into accepting any file. An attacker could place a harmful file there and cause it to run, potentially taking control of the system. Install the vendor’s latest patch or temporarily block file uploads until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
trend micro	apex central	All versions
trendmicro	apex_central	2019 `cpe:2.3:a:trendmicro:apex_central:2019:-::::::`
trendmicro	apex_one	All versions `cpe:2.3:a:trendmicro:apex_one:-:::::saas::`

Original advisory text

Trend Micro Apex Central Arbitrary File Upload Vulnerability

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.

References

https://appweb.trendmicro.com/supportNews/NewsDetail.aspx?id=4435 Vendor Advisory
https://jvn.jp/vu/JVNVU99107357 Third Party Advisory VDB Entry
https://success.trendmicro.com/jp/solution/000290660 Mitigation Patch Vendor Advisory
https://success.trendmicro.com/solution/000290678 Mitigation Patch Vendor Advisory
https://www.jpcert.or.jp/english/at/2022/at220008.html Third Party Advisory VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-... US Government Resource

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 3 days

and check for signs of compromise

Known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

19% chance of attack within 30 days

Type

CWE-345Insufficient Verification of Data Authenticity

Timeline

Published29 Mar 2022

Updated16 Oct 2026

First seen6 Mar 2026

Sources

CVE-2022-26871 · CISA KEV

CVE-2022-26871 · NVD

Track software like this

Free during beta