CVE-2022-26871

Trend Micro Apex Central

Published 29 Mar 2022 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 31 Mar 2022, with a remediation deadline of 21 Apr 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.

References

appweb.trendmicro.com/supportNews/NewsDetail.aspx?id=4435 · Vendor Advisory
jvn.jp/vu/JVNVU99107357 · Third Party Advisory, VDB Entry
success.trendmicro.com/jp/solution/000290660 · Mitigation, Patch, Vendor Advisory
success.trendmicro.com/solution/000290678 · Mitigation, Patch, Vendor Advisory
www.jpcert.or.jp/english/at/2022/at220008.html · Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26871 · US Government Resource