Secuno
ENNL
Book demo

CVE-2022-40139

Trend Micro Apex One and Apex One as a Service Improper Validation

7.2 HIGHActively exploited (CISA KEV)EPSS 3.29%
  1. Published19 Sept 2022
  2. Added to CISA KEV15 Sept 2022
  3. Remediation due6 Oct 2022
Actively exploited (CISA KEV)

Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.

Added to KEV: 15 Sept 2022Federal remediation due: 6 Oct 2022

Description

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredHigh
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Trend Micro Apex One2019

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Frequently asked

Is CVE-2022-40139 being actively exploited?

Yes. CVE-2022-40139 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 15 Sept 2022.

How severe is CVE-2022-40139?

CVE-2022-40139 has a CVSS 3.1 base score of 7.2, rated high. EPSS estimates a 3.29% probability of exploitation.

Which products are affected by CVE-2022-40139?

Affected products include Trend Micro Apex One.

How do I fix CVE-2022-40139?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2022-40139 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.