Trend Micro · Apex Central
CVE-2022-26871
Trend Micro Apex Central Arbitrary File Upload Vulnerability
Exploited in attacks
Critical 9.8 Attack chance: 19%
What it is
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
CISA: An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 21, 2022
More exploited flaws from Trend Micro
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 21, 2026 | (On-Premise) Directory Traversal | Apex One | Medium 6.7 | 13% |
| Aug 18, 2025 | OS Command Injection | Apex One | Critical 9.4 | 25% |
| Sep 21, 2023 | Remote Code Execution | Apex One and Worry-Free Business Security | High 7.2 | 4.2% |
| Sep 15, 2022 | Improper Validation | Apex One and Apex One as a Service | High 7.2 | 3.4% |
| Nov 3, 2021 | Remote Code Execution | Apex One and OfficeScan | High 8.8 | 11% |
| Nov 3, 2021 | Multiple Products Content Validation Escape | Apex One, OfficeScan and Worry-Free Business Security Agents | High 8.8 | 6.2% |
| Nov 3, 2021 | Authentication Bypass | Apex One and OfficeScan | Critical 9.8 | 12% |
| Nov 3, 2021 | Directory Traversal | OfficeScan | High 8.8 | 25% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.