A directory traversal vulnerability in the Apex One

CVE-2026-34926 is a CWE-23 directory traversal flaw in Trend Micro Apex One 2019 (on-prem). The vendor says affected builds are server and agent builds below 17079, and fixes are available as SP1 Build 17079 for fresh installs or SP1 Critical Patch Build 18012 for existing SP1 deployments. Exploitation is not internet-preauth RCE: the attacker must already have access to the Apex One server and administrative credentials on that server, then abuse the flaw to modify a key table and inject code that gets deployed to managed agents.

Trend's MEDIUM 6.7 score is technically defensible for the exploit primitive, but it undersells the operational blast radius. Once you factor in confirmed in-the-wild exploitation and the fact that the target is a central endpoint management plane capable of pushing code to many hosts, this stops looking like a routine local bug and starts looking like a high-value post-compromise pivot. The decisive downgrade pressure is the prerequisite stack: local reachability + admin rights on the Apex server means this is usually *after* initial access, not before it.

Why this verdict

• Upgrade from vendor MEDIUM: KEV listing on 2026-05-21 and vendor-confirmed in-the-wild attempts mean this is no longer a hypothetical local bug.
• Blast radius amplifier: the vulnerable component is the Apex One management server, so a single exploited host can become a trusted code-delivery channel to many endpoints.
• Friction audit keeps it out of CRITICAL: step 1 requires local/internal reachability plus admin rights on the server, which implies prior compromise or privileged credential theft and sharply narrows the reachable population.
• Population is limited: only on-prem Apex One 2019 servers below the fixed builds are exposed; SaaS tenants are not the vulnerable server-side target here.
• Modern controls should stop prerequisites: MFA on admin paths, PAM, jump hosts, EDR, server segmentation, and restricted console access should all reduce how often an attacker can satisfy the initial conditions.

Why not higher?

This is not unauthenticated remote internet RCE. The attacker already needs to be on or into the server path and already hold admin-level access on the Apex server, which means much of the damage potential depends on an earlier compromise succeeding first. That prerequisite stack is a major real-world brake on mass exploitation.

Why not lower?

Apex One is a management-plane product, not an isolated workstation app. Once exploited, the vulnerability can let an attacker turn a trusted security server into a fleet distribution mechanism, and that is exactly the kind of leverage that justifies keeping it above MEDIUM. KEV listing removes any comfort that the awkward prerequisites make it purely theoretical.

1. Lock down admin entry paths — Restrict RDP, SMB, WinRM, console, and jump-host access to the Apex One server to a tiny admin group and require MFA/PAM where possible. Because this CVE is KEV-listed, apply this within hours, not on a normal 30-day cycle.
2. Isolate the management server — Move the Apex One server into a hardened admin segment and block user-VLAN reachability to its management ports except from approved admin networks. Do this within hours to cut off the most realistic attacker path: reusing existing internal access against a high-trust server.
3. Monitor PCCSRV for unauthorized change — Add file integrity monitoring, EDR watch rules, and SIEM alerts for changes in the Apex One server directory, especially PCCSRV content, service binaries, and configuration/database artifacts tied to agent distribution. Deploy within hours because exploitation aims to tamper with trusted server-side data.
4. Require change scrutiny for agent pushes — Tighten operational review of Apex-originated content updates, package pushes, and unusual agent-wide actions until all servers are patched. Implement within hours so a compromised server cannot quietly fan out malicious changes.
5. Inventory every Apex One server — Use internal discovery tools such as runZero and CMDB data to identify all on-prem Apex One instances and confirm which are below build 17079 or missing CP 18012. Start immediately so you can scope and close the exposure while the KEV signal is fresh.

Run this on the Apex One server itself in an elevated PowerShell session. Example: powershell.exe -ExecutionPolicy Bypass -File .\check-apexone-cve-2026-34926.ps1. Local admin rights are recommended because the script reads install locations and registry uninstall data; it outputs VULNERABLE, PATCHED, or UNKNOWN and exits 1, 0, or 2 respectively.

# check-apexone-cve-2026-34926.ps1

# Verifies whether a Windows host running Trend Micro Apex One on-prem appears patched

# for CVE-2026-34926 based on detected server build/version.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Get-BuildFromVersionString {
    param([string]$VersionString)
    if ([string]::IsNullOrWhiteSpace($VersionString)) { return $null }
    $m = [regex]::Match($VersionString, '(\d+)\.(\d+)\.(\d+)\.(\d+)')
    if ($m.Success) {
        return [int]$m.Groups[4].Value
    }
    $m2 = [regex]::Match($VersionString, '(\d{5})')
    if ($m2.Success) {
        return [int]$m2.Groups[1].Value
    }
    return $null
}

function Emit-Result {
    param(
        [string]$State,
        [string]$Detail,
        [int]$Code
    )
    Write-Output "$State - $Detail"
    exit $Code
}

$patchedThreshold = 17079
$detected = @()

# Common Apex One / OfficeScan server locations

$paths = @(
    (Join-Path $env:ProgramFiles 'Trend Micro\Apex One\PCCSRV'),
    (Join-Path ${env:ProgramFiles(x86)} 'Trend Micro\Apex One\PCCSRV'),
    (Join-Path ${env:ProgramFiles(x86)} 'Trend Micro\OfficeScan\PCCSRV'),
    (Join-Path $env:SystemDrive 'PCCSRV')
) | Select-Object -Unique

$fileCandidates = @(
    'OfcService.exe',
    'TmListen.exe',
    'NtrtScan.exe',
    'PccNTMon.exe'
)

foreach ($root in $paths) {
    if (-not (Test-Path $root)) { continue }

    foreach ($name in $fileCandidates) {
        $full = Join-Path $root $name
        if (Test-Path $full) {
            $item = Get-Item $full
            $ver = $item.VersionInfo.FileVersion
            $build = Get-BuildFromVersionString -VersionString $ver
            if ($build) {
                $detected += [pscustomobject]@{
                    Source = $full
                    Version = $ver
                    Build = $build
                }
            }
        }
    }
}

# Fallback: check uninstall registry entries

$uninstallRoots = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

foreach ($u in $uninstallRoots) {
    Get-ItemProperty $u | Where-Object {
        $_.DisplayName -match 'Apex One|OfficeScan'
    } | ForEach-Object {
        $ver = $_.DisplayVersion
        $build = Get-BuildFromVersionString -VersionString $ver
        if ($build) {
            $detected += [pscustomobject]@{
                Source = "Registry: $($_.DisplayName)"
                Version = $ver
                Build = $build
            }
        }
    }
}

if (-not $detected -or $detected.Count -eq 0) {
    Emit-Result -State 'UNKNOWN' -Detail 'Apex One / OfficeScan server build could not be determined on this host.' -Code 2
}

$best = $detected | Sort-Object Build -Descending | Select-Object -First 1

if ($best.Build -ge $patchedThreshold) {
    Emit-Result -State 'PATCHED' -Detail ("Detected build {0} from {1} (version {2}); threshold is {3}." -f $best.Build, $best.Source, $best.Version, $patchedThreshold) -Code 0
}
else {
    Emit-Result -State 'VULNERABLE' -Detail ("Detected build {0} from {1} (version {2}); below fixed threshold {3}." -f $best.Build, $best.Source, $best.Version, $patchedThreshold) -Code 1
}

Sources

1. TrendAI security bulletin
2. NVD CVE entry
3. JVN advisory
4. CISA KEV data mirror
5. runZero asset discovery guidance
6. TrendAI ports and protocols documentation
7. Help Net Security coverage of active exploitation
8. Pinaka EPSS mirror for percentile context