high Known exploitedREV. 01
CVE-2022-40139Trend Micro Apex One — Unverified Rollback Package
Trend Micro Apex One clients do not properly validate rollback components, so someone with server admin console access can make clients download an unverified package, which could lead to RCE on those clients.
Read the risk
THE VITAL STATS- CVSS score
- 7.2/ 10 CVSS v3.1
- EPSS probability
- 3.4% Likelihood of exploitation
- Attack complexity
- Low Conditions needed to exploit
- Known exploited
- Yes — CISA KEV
- CVE published
- 2022-09-19
- Added to KEV
- 2022-09-15
- CISA due date
- 2022-10-06
- Exploit published
- Not recorded
- Confidence
- high
- Kill chain
- execution
- MITRE ATT&CK
- —
- Severity
- high
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attacker needsAccess to the Apex One server administration console.
Behind the card
3 REFERENCES- 01CVE recordNVD recordnvd.nist.gov
- 02CISACISA Known Exploited Vulnerabilities catalogcisa.gov
- 03Vendor advisorysuccess.trendmicro.comsuccess.trendmicro.com
Field-level provenanceTRACE THE SOURCES +
Which source supports each field, when it was retrieved, and who extracted it.
| Fields | Source | Retrieved | Extractor | Confidence |
|---|---|---|---|---|
| cvss, exploitation.attack_complexity, exploitation.exploit_available, published_at, references | nvd.nist.gov | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| exploitation.known_exploited, exploitation.kev_added, exploitation.kev_due | cisa.gov | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| epss | api.first.org | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| title, subtitle, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites | nvd.nist.gov | 2026-11-05 | claude-code | high |
Printing history
THE RECORD- r1Initial base card
History unavailable — this build has no Git history for the card file.