CVEvulnerability

CVE-2022-26871

9.8 CRITICAL Known exploited Published 2022-03-29 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Trend Micro Apex Central Arbitrary File Upload Vulnerability — Trend Micro Apex Central

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.

Added to KEV: 2022-03-31
Remediation due: 2022-04-21
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-26871

Status: Analyzed
Published: 2022-03-29
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses: CWE-345

Description

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.

Affected configurations

• trendmicro apex central 2019 • trendmicro apex one

Weakness · CWE (1)

CWE-345 Insufficient Verification of Data Authenticity weakness

References