Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-34927 (ZDI-CAN-27959) |
| Alert Source | Trend Micro Security Bulletin (KA-0023430) |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-28 |
| Vendor | Trend Micro |
| Product | Apex One / Vision One Endpoint Security SEP |
| Vulnerability Type | Origin Validation Error (CWE-346) - Local Privilege Escalation |
| CVSS Score | 7.8 (high) |
| CVSS Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: Trend Micro Security Bulletin
An origin validation vulnerability in the Trend Micro Apex One / Standard Endpoint Protection (SEP) agent could allow a local attacker to escalate privileges on affected installations. Note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2026-34927 is the first of 7 similar LPE vulnerabilities of class CWE-346 (origin validation) in the SEP agent, published in bulletin KA-0023430. The remaining 6 (CVE-2026-34928, 34929, 34930, 45206, 45207, 45208) differ only in the IPC mechanism affected (named pipes, process protection, TOCTOU). The bulletin also covers CVE-2026-34926 — a directory traversal in the Apex One server (actively exploited).
Required Actions
All 8 vulnerabilities in bulletin KA-0023430 are addressed in a single patch package — one update eliminates the entire set:
- Apex One (on-prem): SP1 CP Build 18012 (or SP1 Build 17079 for fresh installs); agent at least 14.0.0.17079
- Apex One as a Service / Vision One Endpoint Security SEP: Security Agent build 14.0.20731, Windows
Mitigating factors (per Trend Micro): exploitation of these vulnerabilities generally requires that an attacker has access (physical or remote) to the system and already has the ability to execute low-privileged code. Nonetheless, LPE in an EDR agent is an important vector for advanced attacks — it allows an attacker to obtain SYSTEM/admin and disable the EDR protection layer.
Who Is Affected?
This vulnerability affects organizations deploying Trend Micro Apex One (on-prem 2019) and Apex One as a Service / Vision One Endpoint Security SEP in Windows environments. Builds:
- Apex One 2019 (on-prem): Server and Agent < 17079
- Apex One as a Service / Vision One SEP: Agent < 14.0.20731
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
