CVE-2022-40139

What it actually does

The flaw is an improper validation issue in the Trend Micro Apex One and Apex One as a Service client rollback mechanism. A user with Apex One server administration console access can cause managed endpoint clients to download a rollback package that is not sufficiently verified. If the rollback package is attacker-controlled, endpoint clients can execute attacker-supplied code, potentially with the privileges of the Trend Micro agent service, resulting in full compromise of affected endpoints. The vulnerability requires prior administrative access to the Apex One server console but does not require user interaction on the endpoint clients.

Why it matters to the business

Compromise of the Apex One management plane can become compromise of many protected endpoints at once, because the security platform is trusted to distribute updates and rollback packages broadly. Successful exploitation could let an attacker deploy malware, disable security controls, steal data, move laterally, or disrupt operations across managed workstations and servers. This vulnerability is listed in CISA KEV with active exploitation in the wild and had a federal remediation due date of 2022-10-06, so unpatched deployments should be treated as high-priority legacy exposure even though the EPSS score is modest.

How an attack unfolds

An attacker first obtains access to the Apex One server administration console, typically through stolen administrator credentials, session theft, phishing, credential reuse, or another vulnerability affecting the management server. After authenticating with sufficient privileges, the attacker abuses the rollback workflow by configuring or instructing clients to retrieve a rollback package that has not been properly validated by the affected client logic. Managed clients trust instructions from the Apex One server, download the unverified rollback content, and process it as part of the rollback operation. The malicious package can then execute code on endpoints, allowing the attacker to install tools, persist, disable protections, dump credentials, or use the compromised fleet for lateral movement. Because exploitation depends on administrator console access, investigations should treat any unexpected rollback activity as a potential sign of prior management-plane compromise.

How to fix it

Apply the vendor security update or hotfix for Trend Micro Apex One and confirm Apex One as a Service tenants and endpoint agents have received the corrected components. Because exploitation requires console access, also harden the management plane: enforce MFA for administrators, restrict console access to trusted networks or VPN, remove unused administrator accounts, apply least privilege, rotate privileged credentials, and review active sessions/API tokens. Temporarily disable or tightly control rollback functionality where operationally feasible until all clients are confirmed remediated. If the supplied asset metadata also tracks unrelated Chromium packages, ensure Debian 11/12/13 chromium is at least 87.0.4280.88-0.1 and Ubuntu 16.04 chromium-browser is at least 85.0.4183.83-0ubuntu0.16.04.2, but remediation for this vulnerability should be driven by Trend Micro Apex One vendor guidance.

How to confirm the fix worked

Confirm the Apex One server build, hotfix level, and agent component versions match Trend Micro’s fixed releases for this issue. Verify that all managed clients have received updated agent components, not just that the management server was patched. From an exposure perspective, confirm the administration console is not internet-exposed unless explicitly required and protected, validate MFA and access controls for all administrative users, and review whether rollback functionality is still enabled. Test patch effectiveness by confirming rollback packages are cryptographically validated or rejected when unsigned, tampered, or from untrusted sources in a controlled non-production environment. Asset and vulnerability scanners should no longer report affected Apex One or Apex One as a Service client versions after remediation.

Typical attack path

1. Gain Apex One server administration console access through credential theft, phishing, session hijacking, credential reuse, or exploitation of another weakness.
2. Identify managed clients or groups that can receive rollback instructions from the Apex One server.
3. Prepare or stage a malicious rollback package that will be accepted by affected clients due to insufficient validation.
4. Use the Apex One administration console or server-side management functions to instruct clients to download the rollback package.
5. Affected clients retrieve and process the unverified rollback content.
6. Attacker-controlled code executes on endpoints, potentially under high-privilege security agent context.
7. Use endpoint access to establish persistence, disable defenses, collect credentials, exfiltrate data, or move laterally.

How to detect it

Investigate both the Apex One management server and managed endpoints. On the server, review administration console authentication logs, administrator activity logs, audit trails, configuration changes, rollback-related events, package repository changes, web access logs, and any API activity for unusual administrator logins or rollback actions. Prioritize logins from unfamiliar IP addresses, impossible travel, unusual user agents, new administrator accounts, privilege changes, failed login bursts followed by success, and activity outside maintenance windows. On endpoints, correlate Trend Micro agent activity with process creation telemetry, EDR events, file writes, service creation, scheduled tasks, registry Run keys, and outbound network connections immediately after rollback events. Look for executions spawned by Trend Micro Apex One or Security Agent processes that launch scripting interpreters, command shells, archive tools, download utilities, or unsigned binaries. Preserve and inspect any rollback packages found on the server or clients; compare hashes against known-good vendor packages and check signatures. Because the vulnerability requires prior console access, detection should also include credential compromise investigation for Apex One administrators.

• rollback package
• Rollback
• unverified rollback
• Apex One rollback
• Trend Micro Apex One
• Apex One as a Service
• OfficeScan
• C:\Program Files (x86)\Trend Micro\Apex One\PCCSRV\
• C:\Program Files\Trend Micro\Apex One\PCCSRV\
• C:\Program Files (x86)\Trend Micro\Security Agent\
• C:\Program Files\Trend Micro\Security Agent\
• PCCSRV
• Security Agent
• TmListen.exe
• NTRtScan.exe
• PccNTMon.exe
• cmd.exe /c
• powershell.exe
• wscript.exe
• cscript.exe
• mshta.exe
• rundll32.exe
• regsvr32.exe
• schtasks.exe
• sc.exe create

What your security team should do

• Patch Apex One server and client components immediately where still exposed; this is a CISA KEV vulnerability with documented exploitation in the wild.
• Audit Apex One administrator accounts, recent logins, role changes, and active sessions for signs of unauthorized access before assuming patching alone is sufficient.
• Search for unexpected rollback operations, rollback package downloads, and endpoint execution events initiated by Trend Micro agent processes.
• Restrict Apex One console access using MFA, network allowlisting, VPN or zero-trust access controls, and least-privilege roles.
• Rotate Apex One administrator credentials and any credentials that may have been stored, used, or accessible on the management server if suspicious activity is found.
• Hunt across managed endpoints for new services, scheduled tasks, startup items, or payloads created around the time of any rollback activity.
• If exploitation is suspected, preserve Apex One server logs, web/admin logs, endpoint agent logs, package repositories, and suspicious rollback files before cleanup.
• Monitor vendor advisories for any additional Apex One hotfixes and confirm Apex One as a Service environments have completed automatic remediation.