Actively exploited · Published Mar 29, 2022 · Assigned by trendmicro
CVE-2022-26871
Critical 9.8 Exploited
In plain English
A critical-severity insufficient verification of data authenticity in Trend Micro Apex Central from Trend Micro. Attackers are actively exploiting it in the wild (listed by CISA on March 31, 2022). The chance it is exploited in the next 30 days is estimated at 19.5% (higher than 97% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 21, 2022.
Official description
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Trend Micro | Trend Micro Apex Central | 2019 (on-premise), SaaS |
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://success.trendmicro.com/solution/000290678 x_refsource_MISC
- https://success.trendmicro.com/jp/solution/000290660 x_refsource_MISC
- https://www.jpcert.or.jp/english/at/2022/at220008.html x_refsource_MISC
- https://jvn.jp/vu/JVNVU99107357 x_refsource_MISC
- https://appweb.trendmicro.com/supportNews/NewsDetail.aspx?id=4435 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26871 government-resource