Trend Micro users beware - dangerous Apex One zero-day exploited in the wild

Development Micro patches CVE‑2026‑34926, a medium‑severity listing traversal flaw in Apex One (on‑prem) that lets native admins inject malicious code
Regardless of requiring prior admin entry, the bug is already being exploited within the wild, prompting pressing patching steering
CISA provides it to the KEV catalog, giving federal companies till June 4 2026 to replace or discontinue use per BOD 22‑01 directives

A harmful vulnerability in Development Micro’s Apex One product is being actively abused within the wild, researchers have warned, urging customers to use the supplied patch as quickly as attainable.

Apex One is Development Micro’s endpoint protection platform (EPP) constructed to guard enterprise units from malware, ransomware, fileless assaults, and numerous different cyber-threats. It makes use of a mixture of antivirus capabilities, behavioral evaluation, machine studying, and EDR/XDR. It seems to be somewhat in style, with some sources counting the variety of prospects within the hundreds.

The corporate has now issued a patch for a listing traversal vulnerability within the on-prem variant of Apex One which may permit native actors (with admin privileges) to inject malicious code.

Newest Movies From

Capturing tokens

“A listing traversal vulnerability within the Apex One (on-premise) server may permit a pre-authenticated native attacker to switch a key desk on the server to inject malicious code to deploy to brokers on affected installations,” the NVD entry reads.

“This vulnerability is just exploitable on the on-premise model of Apex One and a possible attacker should have entry to the Apex One Server and already obtained administrative credentials to the server by way of another technique to take advantage of this vulnerability.”

The bug is now tracked as CVE-2026-34926 and carries a severity rating of 6.7/10 (medium).

Whereas all of it factors to a considerably low-risk vulnerability, Development Micro stated that it noticed “not less than one” exploitation try, already.

We don’t know if one try is sufficient to get listed in CISA’s Identified Exploited Vulnerabilities (KEV) database, however the US company simply did that. Final Thursday, CISA disclosed a brand new entry within the catalog, giving Federal Civilian Govt Department (FCEB) companies a deadline of June 4 to use the patch or cease utilizing Apex One fully.

“These kind of vulnerabilities are frequent assault vectors for malicious cyber actors and pose important dangers to the federal enterprise,” CISA stated. “Apply mitigations per vendor directions, observe relevant BOD 22-01 steering for cloud providers, or discontinue use of the product if mitigations are unavailable.”

By way of BleepingComputer