CVE-2022-26871

critical

Description

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.

References

https://www.jpcert.or.jp/english/at/2022/at220008.html

https://jvn.jp/vu/JVNVU99107357

https://www.bleepingcomputer.com/news/security/trend-micro-fixes-critical-rce-flaw-in-apex-central-console/

https://www.mandiant.com/resources/blog/zero-days-exploited-2022

https://www.tenable.com/cyber-exposure/tenable-2022-threat-landscape-report

https://success.trendmicro.com/dcx/s/solution/000290678?language=en_US&sfdcIFrameOrigin=null

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26871

https://success.trendmicro.com/solution/000290678

https://success.trendmicro.com/jp/solution/000290660

https://appweb.trendmicro.com/supportNews/NewsDetail.aspx?id=4435

Details

Source: Mitre, NVD

Published: 2022-03-29

Updated: 2025-12-22

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.15322

Detections

Analytics