CVE-2026-34928: Trend Micro Apex One origin validation privilege escalation in agent named pipe

CVE-2026-34928 · Severity: high · CVSS 7.8 · Published 2026-05-21

Trend Micro Apex One and Vision One endpoint agents are affected by a security flaw that could allow a user with limited access to gain full administrative control over a computer. These agents are security software used to protect corporate laptops and servers from malware and cyberattacks. To exploit this, an attacker must already have the ability to run basic commands on the target machine, but once successful, they could bypass security controls or access sensitive data.

Technologies: Trend Micro Apex One Agent, Trend Micro Apex One as a Service Agent, Trend Micro Vision One Endpoint Security Agent. Vendors: Trend Micro.

Quick answers

Is CVE-2026-34928 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34928 being exploited in the wild.
How severe is CVE-2026-34928?
High severity, with a CVSS score of 7.8, published 21 May 2026.
Which products and versions are affected?
Trend Micro Apex One as a Service Agent Builds below 14.0.20731.
Is there a fix for CVE-2026-34928?
A patch was published on 2026-05-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34928 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-34928?
Check whether you run Trend Micro Apex One Agent, Trend Micro Apex One as a Service Agent or Trend Micro Vision One Endpoint Security Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An origin validation vulnerability (CWE-346) exists within the named pipe communication mechanism of the Trend Micro Apex One and Vision One Standard Endpoint Protection (SEP) agents. The flaw stems from insufficient verification of the source of inter-process communications. A local attacker who has already achieved low-privileged code execution on a Windows system can exploit this vulnerability to communicate with the agent's named pipes and escalate their privileges to a higher level. Trend Micro has released patches for both on-premise (Build 17079/18012) and SaaS (Build 14.0.20731) versions to address this issue.

Affected products

  • Trend Micro Apex One (on-prem) Agent Builds below 17079
  • Trend Micro Apex One as a Service Agent Builds below 14.0.20731
  • Trend Micro Vision One Endpoint Security - Standard Endpoint Protection (SEP) Agent Builds below 14.0.20731

Timeline

  • 2026-05-21: disclosed
  • 2026-05-21: advisory
  • 2026-05-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.