CVE-2022-41746

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-10 · updated 2026-06-17
Weakness: CWE-425

Description

A forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to the Apex One console on affected installations to escalate privileges and modify certain agent groupings. Please note: an attacker must first obtain the ability to log onto the Apex One web console in order to exploit this vulnerability.

Affected products

Trend Micro Apex One: 2019

References

https://success.trendmicro.com/solution/000291645
https://www.zerodayinitiative.com/advisories/ZDI-22-1403/
https://success.trendmicro.com/solution/000291645
https://www.zerodayinitiative.com/advisories/ZDI-22-1403/

Get alerted when CVE-2022-41746 or the next vulnerability affects your stack