Trend Micro Apex One Multiple Vulnerabilities

Multiple vulnerabilities were identified in Trend Micro Apex One. An attacker could exploit some of these vulnerabilities to trigger elevation of privilege, remote code execution, information disclosure, security restriction bypass and Denial of Service on the targeted system.

Note:
CVE-2022-40139 is being exploited in the wild.

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution.

An attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.