2026-1112-TM-A1-002
Vulnerability from csaf_trendmicro - Published: 2026-11-12 14:00 - Updated: 2026-11-12 14:00Summary
SECURITY BULLETIN: Apex One and Vision One Standard Endpoint Protection (SEP) November 2026 Security Bulletin
Notes
Summary: TrendAI has released updates to Apex One (on-premise) and Apex One as a Service and Vision One – Standard Endpoint Protection (SaaS) to resolve multiple vulnerabilities.
Disclaimer: THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. TREND MICRO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Trend Micro products.
Document License: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/legalcode) If you distribute this content, or a modified version of it, you must provide attribution to Trend Micro, Inc. and provide a link to the original.
Mitigating Factors: Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. In addition to timely application of patches and updated solutions, customers are also advised to review remote access to critical systems and ensure policies and perimeter security is up-to-date.
An insecure permissions vulnerability in Apex One (on-premise) could allow a local attacker to write files to a SYSTEM-trusted directory on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Trend Micro Apex One (2019) On-prem SP1 CP Build 20113
Trend Micro / Apex One
|
cpe:2.3:a:trendmicro:apexone_op:14.0.0.17079:*:*:*:*:*:*:*
|
14.0.0.20113 | |
|
Trend Micro Apex One (2019) On-prem Security Agent SP1 CP Build 20113
Trend Micro / Apex One Security Agent
|
14.0.0.20113 |
Known affected
2 products
An DLL search order hijacking vulnerability in Apex One (on-premise) could allow a local attacker to execute arbitrary code as SYSTEM on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
An OPIC interface access vulnerability in Apex One (on-premise) could allow a local attacker to trigger SYSTEM-level processes or manipulate quarantined files on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
A heap buffer overflow in a specific Apex One service allows an authenticated local user to cause a deterministic denial-of-service by crashing the security agent service.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
5.5 (Medium)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
An uncontrolled search path element in Apex One (on-premise) could allow a local attacker to escalate privileges on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
A COM hijacking vulnerability Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111779 but affects a different component.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
An origin validation vulnerability in the Apex One agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111780 but affects a different component.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
A stack-based buffer overflow vulnerability in the Apex One agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
A heap-based buffer overflow vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
A null pointer deference vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
A heap-based buffer overflow vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111783, but affects a different component.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
An out-of-bounds read vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
A server type confusion vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
A server type confusion vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111787 but affects a different component.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
An origin validation vulnerability in the Apex One agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111781 but affects a different component.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
An origin validation vulnerability in the Apex One agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111789 but affects a different component.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
7.8 (High)
Affected products
Fixed
2 products, the same list as for
CVE-2026-111773
Known affected
2 products, the same list as for
CVE-2026-111773
The PHP Security Team has released advisories addressing two critical, interlinked vulnerabilities in PHP: CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state). Apex One Server (on-premise) updated the version of PHP used in the product to protect against these vulnerabilities. More information can be found in https://success.trendmicro.com/en-US/solution/KA-0024802.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Trend Micro Apex One (2019) On-prem SP1 CP Build 20113
Trend Micro / Apex One
|
cpe:2.3:a:trendmicro:apexone_op:14.0.0.17079:*:*:*:*:*:*:*
|
14.0.0.20113 |
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Trend Micro Apex One (2019) On-prem<14.0.0.20113
Trend Micro / Apex One
|
vers:intdot/<14.0.0.20113 |
Vendor Fix
fix
|
References
15 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "summary",
"text": "TrendAI has released updates to Apex One (on-premise) and Apex One as a Service and Vision One \u2013 Standard Endpoint Protection (SaaS) to resolve multiple vulnerabilities.",
"title": "Summary"
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. TREND MICRO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\n\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Trend Micro products.",
"title": "Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/legalcode) If you distribute this content, or a modified version of it, you must provide attribution to Trend Micro, Inc. and provide a link to the original.",
"title": "Document License"
},
{
"category": "summary",
"text": "Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. In addition to timely application of patches and updated solutions, customers are also advised to review remote access to critical systems and ensure policies and perimeter security is up-to-date.",
"title": "Mitigating Factors"
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@trendmicro.com",
"issuing_authority": "TrendAI PSIRT is responsible for vulnerability handling across all TrendAI supported products, including any end-of-life products.",
"name": "TrendAI (Trend Micro) PSIRT",
"namespace": "https://www.trendmicro.com/vulnerability"
},
"references": [
{
"category": "self",
"summary": "TrendAI Security Bulletin",
"url": "https://success.trendmicro.com/en-US/solution/KA-0024778"
},
{
"category": "self",
"summary": "2026-1112-TM-A1-002 - CSAF Version",
"url": "https://www.trendmicro.com/.well-known/csaf/2026/2026-1112-tm-a1-002.json"
}
],
"title": "SECURITY BULLETIN: Apex One and Vision One Standard Endpoint Protection (SEP) November 2026 Security Bulletin",
"tracking": {
"aliases": [
"KA-0019917"
],
"current_release_date": "2026-11-12T14:00:00.000Z",
"generator": {
"date": "2026-11-12T21:26:47.070Z",
"engine": {
"name": "Secvisogram",
"version": "2.6.19"
}
},
"id": "2026-1112-TM-A1-002",
"initial_release_date": "2026-11-12T14:00:00.000Z",
"revision_history": [
{
"date": "2026-11-12T14:00:00.000Z",
"number": "1",
"summary": "Initial version."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/\u003c14.0.0.20113",
"product": {
"name": "Trend Micro Apex One (2019) On-prem\u003c14.0.0.20113",
"product_id": "TM-A1-001"
}
},
{
"category": "product_version",
"name": "14.0.0.20113",
"product": {
"name": "Trend Micro Apex One (2019) On-prem SP1 CP Build 20113",
"product_id": "TM-A1-002",
"product_identification_helper": {
"cpe": "cpe:2.3:a:trendmicro:apexone_op:14.0.0.17079:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "Apex One"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/\u003c14.0.21067",
"product": {
"name": "Trend Micro Apex One as a Service \u003c14.0.21067",
"product_id": "TM-A1SAAS-001"
}
},
{
"category": "product_version",
"name": "14.0.21067",
"product": {
"name": "Trend Micro Apex One as a Service 14.0.21067",
"product_id": "TM-A1SAAS-002",
"product_identification_helper": {
"cpe": "cpe:2.3:a:trendmicro:apexone_saas:14.0.0.20731:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "Apex One as a Service"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/\u003c14.0.0.20113",
"product": {
"name": "Trend Micro Apex One (2019) On-prem Security Agent\u003c14.0.0.20113",
"product_id": "TM-A1-003"
}
},
{
"category": "product_version",
"name": "14.0.0.20113",
"product": {
"name": "Trend Micro Apex One (2019) On-prem Security Agent SP1 CP Build 20113",
"product_id": "TM-A1-004"
}
}
],
"category": "product_name",
"name": "Apex One Security Agent"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:intdot/\u003c14.0.21067",
"product": {
"name": "Trend Micro Apex One as a Service Agent\u003c14.0.21067",
"product_id": "TM-A1SAAS-003"
}
},
{
"category": "product_version",
"name": "14.0.21067",
"product": {
"name": "Trend Micro Apex One as a Service Security Agent 14.0.21067",
"product_id": "TM-A1SAAS-004"
}
}
],
"category": "product_name",
"name": "Apex One as a Service Security Agent"
}
],
"category": "vendor",
"name": "Trend Micro"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jarret Chan (Jarrett_CHAN@tech.gov.sg)"
]
}
],
"cve": "CVE-2026-111773",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "description",
"text": "An insecure permissions vulnerability in Apex One (on-premise) could allow a local attacker to write files to a SYSTEM-trusted directory on affected installations.",
"title": "CVE description"
},
{
"category": "description",
"text": "This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T14:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Security Agent Temp Directory Insecure Permissions"
},
{
"acknowledgments": [
{
"names": [
"Jarret Chan (Jarrett_CHAN@tech.gov.sg)"
]
}
],
"cve": "CVE-2026-111774",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "description",
"text": "An DLL search order hijacking vulnerability in Apex One (on-premise) could allow a local attacker to execute arbitrary code as SYSTEM on affected installations.",
"title": "CVE description"
},
{
"category": "description",
"text": "This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "DLL Search Order Hijacking Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Jarret Chan (Jarrett_CHAN@tech.gov.sg)"
]
}
],
"cve": "CVE-2026-111775",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "description",
"text": "An OPIC interface access vulnerability in Apex One (on-premise) could allow a local attacker to trigger SYSTEM-level processes or manipulate quarantined files on affected installations.",
"title": "CVE description"
},
{
"category": "description",
"text": "This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Unprivileged OIPC Interface Access Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Jarret Chan (Jarrett_CHAN@tech.gov.sg)"
]
}
],
"cve": "CVE-2026-111776",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A heap buffer overflow in a specific Apex One service allows an authenticated local user to cause a deterministic denial-of-service by crashing the security agent service.",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-21T13:00:00.000Z",
"details": "Update to SP1 CP Build 17079 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-05-21T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.20731 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 5.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Service Heap Buffer Overflow Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Natnael Samson (@NattiSamson) working with TrendAI Zero Day Initiative"
]
}
],
"cve": "CVE-2026-111777",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "description",
"text": "An uncontrolled search path element in Apex One (on-premise) could allow a local attacker to escalate privileges on affected installations. ",
"title": "CVE description"
},
{
"category": "description",
"text": "This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-30350",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Uncontrolled Search Path Element Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111778",
"cwe": {
"id": "CWE-269",
"name": "Improper Privilege Management"
},
"notes": [
{
"category": "description",
"text": "A COM hijacking vulnerability Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. ",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-30495",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "COM Hijacking Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111779",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"notes": [
{
"category": "description",
"text": "An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. ",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-30436",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Security Agent Origin Validation Error Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111780",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"notes": [
{
"category": "description",
"text": "An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111779 but affects a different component.",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-30282",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Security Agent Origin Validation Error Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111781",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"notes": [
{
"category": "description",
"text": "An origin validation vulnerability in the Apex One agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111780 but affects a different component.",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-30497",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Security Agent Origin Validation Error Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111782",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A stack-based buffer overflow vulnerability in the Apex One agent could allow a local attacker to escalate privileges on affected installations. ",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-30858",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Stack-based Buffer Overflow Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111783",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A heap-based buffer overflow vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-29794",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Heap-based Buffer Overflow Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111784",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A null pointer deference vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. ",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-29793",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Security Agent Null Pointer Dereference Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111785",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "description",
"text": "A heap-based buffer overflow vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111783, but affects a different component.",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-30002",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Heap-based Buffer Overflow Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111786",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "An out-of-bounds read vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-30215",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Out-of-Bounds Read Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111787",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "A server type confusion vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-30179",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Server Type Confusion Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111788",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "A server type confusion vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111787 but affects a different component.",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-30179",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Server Type Confusion Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111789",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"notes": [
{
"category": "description",
"text": "An origin validation vulnerability in the Apex One agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111781 but affects a different component.",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-29177",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Security Agent Origin Validation Error Local Privilege Escalation Vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Lays (@_L4ys)"
],
"organization": "TRAPA Security",
"summary": "working with TrendAI Zero Day Initiative"
}
],
"cve": "CVE-2026-111790",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"notes": [
{
"category": "description",
"text": "An origin validation vulnerability in the Apex One agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-111789 but affects a different component.",
"title": "CVE description"
},
{
"category": "description",
"text": "Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"title": "Preconditions"
}
],
"product_status": {
"fixed": [
"TM-A1-002",
"TM-A1-004"
],
"known_affected": [
"TM-A1-001",
"TM-A1-003"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-29910",
"url": "https://www.zerodayinitiative.com/advisories"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001",
"TM-A1-003"
],
"url": "http://downloadcenter.trendmicro.com/"
},
{
"category": "vendor_fix",
"date": "2026-11-12T13:00:00.000Z",
"details": "Update to Security Agent Version 14.0.21067 or later",
"product_ids": [
"TM-A1SAAS-001",
"TM-A1SAAS-003"
],
"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "Security Agent Origin Validation Error Local Privilege Escalation Vulnerability"
},
{
"cve": "CVE-2026-109618",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "The PHP Security Team has released advisories addressing two critical, interlinked vulnerabilities in PHP: CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state). Apex One Server (on-premise) updated the version of PHP used in the product to protect against these vulnerabilities. More information can be found in https://success.trendmicro.com/en-US/solution/KA-0024802.",
"title": "CVE description"
}
],
"product_status": {
"fixed": [
"TM-A1-002"
],
"known_affected": [
"TM-A1-001"
]
},
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T14:00:00.000Z",
"details": "Update to SP1 CP Build 20113 or later",
"product_ids": [
"TM-A1-001"
],
"url": "http://downloadcenter.trendmicro.com/"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-A1-001",
"TM-A1-003"
]
}
],
"title": "PHP \"RCE via OOM corruption\" (php-src)"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.