CVE-2022-40139: Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 15 Sep 2022, 4 days before the CVE record was published.

How likely is exploitation in the next 30 days?

3.4%

EPSS score, percentile 88.9 of all scored records

How severe?

7.2 High

CVSS v3.1 base score, from CISA's enrichment of the record

What should I do?

Required action (CISA), due 6 Oct 2022: Apply updates per vendor instructions.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected: 2019 (on-prem) and SaaS

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

CISA due date for this action: 6 October 2022.

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

• https://success.trendmicro.com/dcx/s/solution/000291528?language=en_US
• https://nvd.nist.gov/vuln/detail/CVE-2022-40139

Affected products and versions

As listed in the CVE record.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

• CISA added CVE-2022-40139 to its Known Exploited Vulnerabilities (KEV) catalog on 15 Sep 2022.
• CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
• The due date CISA sets for the required action is 6 Oct 2022.
• The CVE record was published on 19 Sep 2022, 4 days after it was added to KEV.
• The CVE record carries a CVSS v3.1 base score of 7.2 (High), taken from CISA's enrichment of the record.
• FIRST's EPSS model puts the probability of exploitation in the next 30 days at 3.4% (percentile 88.9), as of 28 Oct 2026.
• CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

• CWE-353
• CWE-641

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

References

• success.trendmicro.com

More exploited Trend Micro vulnerabilities

• CVE-2026-34926: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability (added 21 May 2026)
• CVE-2025-54948: Trend Micro Apex One OS Command Injection Vulnerability (added 18 Aug 2025)
• CVE-2023-41179: Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability (added 21 Sep 2023)
• CVE-2022-26871: Trend Micro Apex Central Arbitrary File Upload Vulnerability (added 31 Mar 2022)
• CVE-2019-18187: Trend Micro OfficeScan Directory Traversal Vulnerability (added 3 Nov 2021)
• CVE-2020-24557: Trend Micro Multiple Products Improper Access Control Vulnerability (added 3 Nov 2021)