TrendAI Patches Apex One Zero-Day Exploited in the Wild

Source: SecurityWeek — 22 May 2026

What we are tracking

CVE-2026-34926 is a directory traversal flaw that can be exploited against the on-premise version of Apex One. The post TrendAI Patches Apex One Zero-Day Exploited in the Wild appeared first on SecurityWeek.

RingSafe analysis

The painful irony — endpoint-protection software becoming the entry point — is one Indian CISOs running on-prem Apex One should take literally this week. The on-premise Apex One management console is exactly the asset attackers want a foothold on: it has agent-deployment privileges, often a high-privilege service account in Active Directory, and is frequently excluded from the EDR it manages. Map to MITRE ATT&CK T1190 (Exploit Public-Facing Application) and T1068 (Privilege Escalation) via path traversal. For DPDP Section 8, compromise of the EPP/EDR console is itself a reportable incident class because the impact radius covers every endpoint it manages. Patch the on-prem console before the agent fleet; restrict console access to a jump-host segment; rotate any AD service account the Apex One console uses immediately after patching; and hunt for outbound activity from the console host over the last 30 days.

Read the original report

TrendAI Patches Apex One Zero-Day Exploited in the Wild → at SecurityWeek