CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2022-26871

CVSS 9.8v3.1pub. 2022-03-29upd. 2025-12-22

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Trendmicro Apex Central

    APP
    Trendmicro
    2019

  • Trendmicro Apex One

    APP
    Trendmicro
    all versions

CISA KEV — detailsi

Vendori
Trend Micro
Producti
Apex Central
Added to KEVi
March 31, 2022
Remediation deadline (US Federal)i
April 21, 2022(overdue)
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 21 kwietnia 2022
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2025-54948CRITICAL9.4⚠ KEVPL ✓same product

Command injection w Trend Micro Apex One – RCE bez uwierzytelnienia

CVE-2020-8599CRITICAL9.8⚠ KEVPL ✓same product

Trend Micro Apex One / OfficeScan XG — zapis pliku bez uwierzytelnienia i bypass loginu ROOT

CVE-2025-69258CRITICAL9.8PL ✓same product

Krytyczna podatność LoadLibraryEX w Trend Micro Apex Central — RCE jako SYSTEM

CVE-2025-54987CRITICAL9.4PL ✓same product

RCE w Trend Micro Apex One – command injection bez uwierzytelnienia

CVE-2025-49219CRITICAL9.8PL ✓same product

RCE przez insecure deserialization w Trend Micro Apex Central (pre-auth)