CVE-2026-34926
Actively exploited. CVE-2026-34926 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-05-21) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Public exploit code is available. Proof-of-concept or working exploit code for CVE-2026-34926 is indexed in GitHub PoC. Expect opportunistic scanning and exploitation attempts — prioritize remediation.
JPCERT-AT-2026-0014
JPCERT/CC
2026-05-21(Initial)
2026-05-22(Update)
I. Overview
On May 21, 2026, Trend Micro has released the information regarding multiple vulnerabilities in TrendAI Apex One (On Premise), Trend Micro Apex One as a Service, TrendAI Vision One Endpoint Security - Standard Endpoint Protection.
If these vulnerabilities are exploited, an authenticated attacker may be able to tamper with arbitrary files on the server, potentially allowing crafted code to be distributed to the security agent, or escalate privileges.
Trend Micro Incorporated has reported that attacks exploiting the relative path traversal vulnerability in TrendAI Apex One(On Premise) (CVE-2026-34926) have been observed in the wild.Since one of the vulnerabilities has already been exploited in the wild, the users of the affected products are recommended to update the affected system to the latest version as soon as possible.Please refer to the information provided by Trend Micro.
Trend Micro Incorporated
ITW SECURITY BULLETIN: Apex One and Vision One - Standard Endpoint Protection (SEP) May 2026 Security Bulletin
https://success.trendmicro.com/en-US/solution/KA-0023430
II. Affected Products
Affected products are as follows:
- TrendAI Apex One (On Premise)
- Trend Micro Apex One as a Service
- TrendAI Vision One Endpoint Security - Standard Endpoint Protection
According to Trend Micro, the only product that could be vulnerable to the exploitation of the relative path traversal vulnerability(CVE-2026-34926) is TrendAI Apex One (On Premise).
III. Solution
Please consider applying the appropriate patch according to the information provided by Trend Micro. Trend Micro has released the patches listed below that address the vulnerabilities.
TrendAI Apex One (On Premise)
- Apply the patch to the server and security agent.
Trend Micro Apex One as a Service and TrendAI Vision One Endpoint Security - Standard Endpoint Protection
- Apply the patch to the security agent. Since these
CSIRTS triage
- What
- A relative path traversal vulnerability allows authenticated attackers to tamper with arbitrary files on the server.
- Who is affected
- Users of TrendAI Apex One (On Premise) are affected, especially those with the vulnerable version.
- Urgency
- Remediation is urgent as the vulnerability has been exploited in the wild.
- Action
- Update the affected system to the latest version.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-34926
Get an email if CVE-2026-34926 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 96% of all EPSS-scored CVEs.
Exploit availability
Public exploit or proof-of-concept code for CVE-2026-34926 is indexed in these free datasets. Available exploit code raises real-world risk independent of the CVSS score.
- GitHub PoCPublic proof-of-concept repositories on GitHub reference this CVE.look it up ↗
Advisory coverage (2)
- unknownexploitedSecurity Alert: [Updated] Alert Regarding Multiple Vulnerabilities in Trend Micro Products Including TrendAI A…jpcert · 2026-05-22
- criticalexploitedCVE-2026-34926: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerabilitycisa-kev · 2026-05-21
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-34926)