CVE-2026-34926
Description
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
Summary dbcve.org
A directory traversal vulnerability in the Apex One on-premise server allows an authenticated attacker with administrative credentials to traverse the filesystem and modify a critical database table. This modified table can be used to inject malicious code that gets deployed to connected agents, effectively turning the server into a vector for distributing malware to the entire agent fleet.
Mitigation
Apply the vendor patch when available and enforce strict credential management to prevent unauthorized administrative access. Network segment the Apex One server and implement additional access controls around the server and its database.