CVE-2022-26871
Last modified
CVE-2022-26871 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.. CISA has confirmed active exploitation in the wild. EPSS estimates a 19.63% chance of exploitation in the next 30 days.
Description
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Trendmicro | Apex Central | 2019 |
| Trendmicro | Apex One | All versions |
References
- https://jvn.jp/vu/JVNVU99107357Third Party Advisory, VDB Entry
- https://success.trendmicro.com/jp/solution/000290660Mitigation, Patch, Vendor Advisory
- https://success.trendmicro.com/solution/000290678Mitigation, Patch, Vendor Advisory
- https://www.jpcert.or.jp/english/at/2022/at220008.htmlThird Party Advisory, VDB Entry
- https://jvn.jp/vu/JVNVU99107357Third Party Advisory, VDB Entry
- https://success.trendmicro.com/jp/solution/000290660Mitigation, Patch, Vendor Advisory
- https://success.trendmicro.com/solution/000290678Mitigation, Patch, Vendor Advisory
- https://www.jpcert.or.jp/english/at/2022/at220008.htmlThird Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26871US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2022-26871?
How severe is CVE-2022-26871?
How do I fix CVE-2022-26871?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-26866Dell PowerStore Versions before v2.1.1.0. contains a Stored …5.5
- CVE-2022-26867PowerStore SW v2.1.1.0 supports the option to export data to…8
- CVE-2022-26868Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x a…7.8
- CVE-2022-26869Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contai…9.8
- CVE-2022-2687A vulnerability, which was classified as critical, was found…9.8
- CVE-2022-26870Dell PowerStore versions 2.1.0.x contain an Authentication b…9.8
- CVE-2022-26872AMI Megarac Password reset interception via API8.8
- CVE-2022-26873A potential attacker can execute an arbitrary code at the ti…8.2
- CVE-2022-26874lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.…5.4
- CVE-2022-26877Asana Desktop before 1.6.0 allows remote attackers to exfilt…6.5
- CVE-2022-26878drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.1…5.5
- CVE-2022-2688A vulnerability was found in SourceCodester Expense Manageme…9.8
Are you affected by CVE-2022-26871?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST