CVE-2022-26871KEV · OVERDUE

Trend Micro Apex Central Arbitrary File Upload Vulnerability

Critical · published March 29, 2022

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 97.4th percentile for exploit probability.

1646
days past CISA
deadline
CVSS v3.1
9.8
EPSS
19%
Percentile
97.4
In the wild
Confirmed
What it is

🚨 A sneaky file upload flaw in Trend Micro Apex Central could let an attacker unleash chaos without breaking a sweat! 🔥 Think of it like a restaurant kitchen where anyone can walk in and leave a surprise ingredient for the chef — except this ingredient could be something downright toxic! If exploited, an attacker could upload any file they desire, leading to potentially devastating remote code execution. This means they could take over the system, access sensitive data, or even launch further attacks. The consequences could be absolutely catastrophic for your organization!

Put simply

Think of it like a restaurant kitchen where anyone can walk in and leave a surprise ingredient for the chef — except this ingredient could be something downright toxic! This vulnerability allows unauthenticated attackers to upload arbitrary files to the server, bypassing normal security checks, and execute malicious code remotely.

What to do

If exploited, an attacker could upload any file they desire, leading to potentially devastating remote code execution. This means they could take over the system, access sensitive data, or even launch further attacks. The consequences could be absolutely catastrophic for your organization! Patch ASAP to the latest version of Trend Micro Apex Central to close this vulnerability. Review your file upload mechanisms to ensure they strictly validate inputs. Consider implementing additional security measures like file type restrictions and rigorous scanning for uploaded files. You've got this! With swift action, you’ll shore up your defenses and protect your systems! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.19481 · 97.4th percentile
Published
2022-03-29T20:45Z
KEV added
2022-03-31 · due 2022-04-21
EPSS history
Timeline
  • 31 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 21
    kev
  • 29 MAR 20:45Z
    An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead…
    cvelistv5