CVE-2022-26871

What it actually does

The vulnerability is an unauthenticated arbitrary file upload flaw in Trend Micro Apex Central. A remote attacker can submit a crafted upload request that bypasses expected validation and places attacker-controlled content on the server. If the uploaded file is executable by the web application stack, such as a web shell or script, the attacker can trigger it remotely and execute commands with the privileges of the Apex Central application or web server account. Because Apex Central is a centralized security management platform, successful exploitation can expose administrative credentials, security policy data, managed endpoint information, and potentially enable broader compromise of connected security infrastructure.

Why it matters to the business

This is a high-impact, remotely exploitable vulnerability that has been exploited in the wild and is listed in CISA KEV, with a remediation due date of 2022-04-21 that is long past. Compromise of Apex Central can undermine an organization’s security operations because attackers may gain control over a platform used to manage endpoint security, monitor threats, and coordinate defenses. Operational consequences can include loss of visibility, endpoint protection disruption, credential theft, lateral movement, incident response delays, and possible full compromise of systems reachable from the management server.

How an attack unfolds

An attacker first identifies an exposed Trend Micro Apex Central instance, typically by scanning for public web interfaces or known product fingerprints. The attacker then sends a crafted unauthenticated file upload request to the vulnerable component, using a filename, content type, or path value that is not properly validated. The uploaded file is placed somewhere the application or web server can access. If the file is a server-side script or web shell, the attacker makes a follow-up HTTP request to execute it. Once code execution is obtained, the attacker commonly runs discovery commands, dumps configuration data, searches for service credentials or API tokens, establishes persistence, and uses the server’s privileged management position to move laterally or tamper with security tooling. Public exploitation and KEV status mean defenders should assume internet-facing unpatched systems have been targeted.

How to fix it

Apply the vendor-supported Trend Micro Apex Central security update or upgrade to a fixed, currently supported release immediately. Because this vulnerability is in CISA KEV and exploitation is active in the wild, do not rely on monitoring alone for exposed systems. If emergency patching is not immediately possible, restrict Apex Central access to trusted administrative networks or VPNs, block direct internet exposure, enforce WAF rules that deny suspicious upload attempts, and monitor for unexpected server-side scripts in application directories. Treat any unpatched internet-facing instance as potentially compromised and perform incident response before returning it to service. The supplied package metadata also lists unrelated Linux package fixed versions; where those packages are actually in scope, ensure Debian 11 linux packages are at 5.10.149-1 or later, Debian 12 and Debian 13 linux packages are at 5.19.6-1 or later, and Ubuntu Pro 14.04 linux-azure packages are at 4.15.0-1162.177~14.04.1 or later. Validate product applicability against the Trend Micro advisory because the core vulnerability described is in Trend Micro Apex Central, not the Linux kernel.

How to confirm the fix worked

Confirm the installed Trend Micro Apex Central version and build level against the official Trend Micro advisory and verify that the security patch is applied. Confirm the Apex Central web interface is not reachable from untrusted networks unless explicitly required and protected by compensating controls. Review web roots, upload directories, temporary directories, and application directories for recently created executable files, especially ASP, ASPX, JSP, PHP, EXE, DLL, BAT, CMD, PS1, VBS, and ZIP files. Validate that uploaded content is stored outside executable web paths and that server-side execution of uploaded files is not possible. Use authenticated vulnerability scanning or vendor tooling where available, and supplement with manual verification of file timestamps, web server logs, and application logs around suspicious upload activity. For package-based systems listed in the metadata, validate using the platform package manager, such as dpkg/apt package version checks, and confirm the running kernel matches the fixed installed package after reboot.

Typical attack path

1. Scan the internet or internal network for Trend Micro Apex Central web interfaces.
2. Confirm the target is a vulnerable or unpatched Apex Central version.
3. Send a crafted unauthenticated file upload request that bypasses file validation controls.
4. Upload a web shell, script, or other executable payload to a web-accessible or application-executable location.
5. Request the uploaded payload over HTTP/S to execute commands on the server.
6. Run reconnaissance commands to identify privileges, network access, product configuration, and stored credentials.
7. Establish persistence using additional files, scheduled tasks, services, or new accounts where possible.
8. Use obtained credentials or management-plane access to pivot to managed systems or weaken security controls.
9. Delete or alter logs, uploaded files, and temporary artifacts to reduce forensic visibility.

How to detect it

To determine whether exploitation already occurred, review Apex Central application logs, web server access logs, upload handling logs, endpoint detection telemetry, Windows Event Logs or Linux audit logs depending on deployment, proxy logs, firewall logs, and file integrity monitoring records. Look for unauthenticated HTTP POST requests to Apex Central upload-related endpoints, especially requests followed by HTTP GET requests to newly created executable files. Hunt for recently created or modified server-side scripts in Apex Central web directories, upload directories, temporary directories, and any directory served by IIS or the product web service. Investigate web server or product service processes spawning command interpreters, scripting engines, download utilities, archiving tools, or credential-dumping utilities. Correlate suspicious HTTP requests with file creation timestamps, process creation events, outbound network connections, and changes to Apex Central administrator accounts or security policies. Because the input does not include actor-specific indicators, prioritize behavior-based detection: arbitrary uploads, web shell execution, unexpected child processes, suspicious outbound callbacks, newly added administrative users, and evidence of log deletion or tampering.

• C:\Program Files (x86)\Trend Micro\Apex Central\WebUI\*.aspx
• C:\Program Files\Trend Micro\Apex Central\WebUI\*.aspx
• C:\Program Files (x86)\Trend Micro\Control Manager\WebUI\*.aspx
• C:\Program Files\Trend Micro\Control Manager\WebUI\*.aspx
• C:\Program Files (x86)\Trend Micro\Apex Central\WebUI\*.asp
• C:\Program Files\Trend Micro\Apex Central\WebUI\*.asp
• C:\Program Files (x86)\Trend Micro\Control Manager\WebUI\*.asp
• C:\Program Files\Trend Micro\Control Manager\WebUI\*.asp
• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> wscript.exe
• w3wp.exe -> cscript.exe
• w3wp.exe -> mshta.exe
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user
• cmd.exe /c net localgroup administrators
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache -split -f
• bitsadmin /transfer
• POST / HTTP/1.1" 200
• POST / HTTP/1.1" 500
• .aspx?cmd=
• .asp?cmd=
• .jsp?cmd=
• .php?cmd=

What your security team should do

• Immediately inventory all Trend Micro Apex Central instances, prioritizing internet-facing and third-party-accessible deployments.
• Patch or upgrade all affected Apex Central systems to the vendor-fixed release; treat this as overdue because it is in CISA KEV with active exploitation.
• Temporarily remove public exposure or restrict access to trusted administrative sources until patching and compromise assessment are complete.
• Perform threat hunting for arbitrary upload and web shell activity on all Apex Central servers, especially around and after the public disclosure date of 2022-03-29.
• Review web server logs for unauthenticated upload requests followed by requests to newly created script files.
• Inspect application, web root, upload, and temporary directories for suspicious executable files and unexpected recent modifications.
• Check for child processes spawned by the web server or Apex Central services, such as cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, wscript.exe, cscript.exe, curl, wget, sh, or bash.
• Rotate credentials, API keys, service account passwords, and administrative secrets stored on or used by Apex Central if compromise cannot be confidently ruled out.
• Review Apex Central administrative users, policies, agent deployment settings, and integrations for unauthorized changes.
• Preserve forensic evidence before remediation where exploitation is suspected, including web logs, application logs, memory captures where feasible, suspicious files, scheduled tasks, services, and process execution telemetry.