Review reviewHigh

CVE-2026-34928

Trend Micro, Inc. TrendAI Apex One, TrendAI Apex One as a Service, apex one

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different named pipe communication mechanism. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVSS: 7.8
EPSS: 0.21%
CISA KEV: Not listed
Published: 2026.05.21

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.21%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Trend Micro, Inc. TrendAI Apex One, TrendAI Apex One as a Service, apex one
Affected versions: >= 2019 (14.0) < 14.0.0.17079, >= SaaS < 14.0.20731, < 14.0.0.17079, < 14.0.20731
Fixed versions: 14.0.0.17079, 14.0.20731

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Trend Micro, Inc. TrendAI Apex One, TrendAI Apex One as a Service, apex one and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-346