A directory traversal flaw in the Trend Micro Apex One on‑premise server lets a local attacker who already has administrative credentials modify a system key table. By altering the table the attacker can inject malicious code that will be automatically deployed to all connected Trend AI agents, giving attackers code execution capability on those endpoints. The weakness is a classic directory traversal (CWE‑23), which allows the attacker to manipulate file paths beyond intended boundaries, resulting in unauthorized file modification and execution.

The vulnerability affects Trend Micro Apex One on‑premise servers running version 14.0.0.17079. The Apex One as a Service version is not vulnerable but the on‑premise deployment is. The flaw is only exploitable when the attacker has already gained local administrative access to the Apex One server via other means.

The CVSS score of 6.7 indicates moderate severity. EPSS data are not available, and the flaw is listed in the CISA KEV catalog. The attack requires a pre‑authenticated local attacker with administrative privileges, so the likelihood of exploitation depends on the security of the Apex One server environment and the difficulty of obtaining those credentials. Once the attacker can modify the key table, any code deployed to agents is executed with the agent’s privileges, potentially compromising the entire managed fleet.