CVE-2022-40139VulnerabilityPublished 09/15/2022Updated 10/24/2026
CVE-2022-40139: Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability
Affects Trend Micro Apex One and Apex One as a ServiceSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 09/15/2022
- KEV deadline
- 10/06/2022
- EPSS
- 3.3% chance of exploitation in 30 days – higher than 88% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.