Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability (CVE-2022-40139)

A remote attacker, with administrative privileges, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2022-10-06 under CISA BOD 22-01.

This vulnerability affects Trend Micro Apex One and Apex One as a Service. Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability. Exploitation requires remote network access, low attack complexity, an administrative account, and no user interaction required.

Probably yes if any of these apply:

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-09-15 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2022-10-06.