CVE-2026-34929: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

CVE-2026-34929 is a local privilege escalation vulnerability (CWE-346: Origin Validation Error) in the Apex One NT Listener service of Trend Micro Apex One and Vision One – Standard Endpoint Protection (SEP) agents. It affects Apex One 2019 on-premises (agent builds below 14.0.0.17079) and Apex One as a Service / Vision One SEP SaaS (agent builds below 14.0.20731) on Windows. The vulnerability was disclosed on May 21, 2026, with a ZDI advisory (ZDI-26-322) published May 28, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Trend Micro Advisory, GitHub Advisory).

The vulnerability stems from insufficient validation of the origin of commands received by the Apex One NT Listener service (CWE-346: Origin Validation Error), allowing a low-privileged local attacker to send crafted inter-process communication (IPC) messages that the service incorrectly trusts. This is one of several related origin validation flaws (CVE-2026-34927 through CVE-2026-34930) discovered by researcher Lays (@_L4ys) of TRAPA Security via the Zero Day Initiative; each variant targets a different IPC mechanism within the Apex One/SEP agent. CVE-2026-34929 specifically involves a distinct IPC channel (ZDI-CAN-28077), separate from the named pipe mechanism used in CVE-2026-34928. Exploitation requires the attacker to already have the ability to execute low-privileged code on the target system (Trend Micro Advisory, ZDI Advisory).

Successful exploitation allows a local attacker to escalate privileges from a low-privileged user to SYSTEM-level on the affected Windows endpoint, achieving full confidentiality, integrity, and availability impact. With SYSTEM privileges, an attacker can execute arbitrary code, access all data on the system, disable security controls, install persistent malware, and potentially use the compromised endpoint as a pivot point for lateral movement within the network. The scope is limited to the affected host (Scope: Unchanged), but SYSTEM-level access effectively grants complete control over the endpoint (Trend Micro Advisory, GitHub Advisory).

Trend Micro has released patches addressing this vulnerability. For Apex One 2019 on-premises, update to SP1 CP Build 18012 (for existing SP1 users) or SP1 Build 17079 (for new installs), ensuring the agent is at least build 14.0.0.17079. For Apex One as a Service and Vision One SEP, update the security agent to build 14.0.20731 or later. As a general mitigation, restrict local code execution capabilities on endpoints, enforce the principle of least privilege for user accounts, and monitor the Apex One NT Listener service for anomalous IPC activity. Customers should also review remote access policies to critical systems (Trend Micro Advisory).

The Belgium Centre for Cybersecurity (CCB) issued a warning regarding multiple vulnerabilities in TrendAI Apex One and Vision One SEP, including CVE-2026-34929, noting active exploitation of a related vulnerability in the same bulletin (CCB Advisory). Japan's JVN and JVNDB also published advisories covering the vulnerability cluster. The discovery was credited to researcher Lays (@_L4ys) of TRAPA Security working through the Zero Day Initiative, and the VulDB community tracked the issue shortly after disclosure (Trend Micro Advisory).