# Multiple vulnerabilities in Trend Micro Apex One and Vision One allow privilege…

Published: 2026-05-22 · Severity: critical
Canonical: https://vorant.io/reports/f7d102c1-0cdb-49e7-9b31-06df7a23e65e/multiple-vulnerabilities-in-trend-micro-apex-one-and-vision-one-allow-privilege

> Multiple vulnerabilities in Trend Micro Apex One and Vision One allow privilege escalation and security policy bypass; CVE-2026-34926 actively exploited.

The French CERT has issued an advisory regarding multiple vulnerabilities affecting Trend Micro Apex One and Vision One Endpoint Security products. These flaws enable attackers to elevate privileges and bypass security policies on affected systems. Trend Micro has confirmed that CVE-2026-34926 is being actively exploited in the wild, elevating the urgency for organizations using these products to apply patches immediately.

Affected versions include Apex One installations without security patch SP1 CP Build 17079 for new deployments and SP1 CP Build 18012 for existing systems, as well as Vision One Endpoint Security versions prior to 14.0.20731. The advisory encompasses eight distinct CVE identifiers spanning both privilege escalation and security policy bypass vulnerabilities.

Organizations running Trend Micro endpoint security solutions should prioritize patching these systems given the active exploitation and the privileged access these security products maintain within enterprise environments. Trend Micro has released patches referenced in security bulletin KA-0023430 dated May 21, 2026.

## Mentioned in this report

- Vulnerabilities: CVE-2026-34926 (KEV), CVE-2026-34927, CVE-2026-34928, CVE-2026-34929, CVE-2026-34930, CVE-2026-45206, CVE-2026-45207, CVE-2026-45208

## Detection guidance (public sample)

### Suspicious Child Process Spawned by Trend Micro Apex One / Vision One Service Binaries

ATT&CK: T1068

Detects command shells or scripting engines spawned from Trend Micro Apex One/Vision One endpoint security processes, which may indicate exploitation of privilege escalation vulnerabilities (e.g. CVE-2026-34926) against the security agent. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process from Trend Micro Apex One Service
id: 97dc96b6-a2e8-5485-bab8-ee5f6c855b42
status: experimental
description: 'Detects cmd.exe, powershell.exe, or other command interpreters being
  spawned as a child process of Trend Micro Apex One or Vision One Endpoint Security
  service binaries. Legitimate Apex One processes rarely spawn interactive shells;
  this pattern can indicate exploitation of a privilege escalation vulnerability (e.g.
  CVE-2026-34926) that abuses the elevated privileges these security products hold.

  '
references:
- https://www.cert.ssi.gouv.fr
author: Vorant
tags:
- attack.t1068
- attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \Trend Micro\
    - TmListen.exe
    - Ntrtscan.exe
    - TmCCSF.exe
    - TmProxy.exe
    - ApexOne
    - PccNTMon.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  filter_updates:
    CommandLine|contains:
    - ConsoleClient
    - /silent
    - TMUpdate
  condition: selection_parent and selection_child and not filter_updates
falsepositives:
- Legitimate Apex One update or maintenance tasks that invoke helper scripts
- Administrative troubleshooting scripts executed via Apex One management console
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0642

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f7d102c1-0cdb-49e7-9b31-06df7a23e65e/multiple-vulnerabilities-in-trend-micro-apex-one-and-vision-one-allow-privilege.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup