Vulnerability in Trend Micro Apex One Exploited in the Wild (CVE-2022-40139)

Trend Micro has patched six vulnerabilities in its Apex One on-prem and software-as-a-service products, one of which has been exploited in the wild. CVE-2022-40139 is an improper validation vulnerability in the “rollback” functionality which is used to revert Apex One agents to older versions. While this vulnerability can only be exploited by an attacker with access to the Apex One administrative console, there have been reports of active exploitation.

For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.