Trend Micro's Apex One antivirus platform and Omnissa's Workspace ONE UEM device management console — two products organizations rely on to secure and administer their entire device fleet — each produced a confirmed-exploited vulnerability, one recent and one that sat dormant for more than four years before being confirmed under active exploitation.
| CVE | CVSS | Product | Issue | Added to KEV |
|---|---|---|---|---|
| CVE-2026-34926 | 6.7 | Trend Micro Apex One (on-premise) | Directory traversal enabling malicious agent code deployment | 21 May 2026 |
| CVE-2021-22054 | 7.5 | Omnissa Workspace ONE UEM | Unauthenticated server-side request forgery | 9 Mar 2026 |
Why a directory traversal bug in an antivirus console deserves outsized attention despite a "medium" score
CVE-2026-34926 carries a CVSS score of 6.7 — MEDIUM severity by the standard rating bands — which on its face reads as one of the less urgent entries in this dataset. But NVD's own description undercuts a purely score-driven read of the risk: the flaw allows "a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations." That is not a bug confined to the Apex One server itself — it is a path from the management console to every endpoint agent that server administers. NVD is explicit that exploitation requires the attacker to have "already obtained administrative credentials to the server via some other method," which is precisely why the score sits at medium rather than critical: this is a privilege-escalation-adjacent bug, not an initial-access one. But an antivirus management server that has already been administratively compromised, and from which an attacker can now push malicious code to every managed endpoint, describes a worst-case scenario for exactly the kind of software organizations deploy specifically to prevent that outcome. The security tool becomes the distribution mechanism for the compromise it exists to stop.
Why a 2021 SSRF bug resurfacing in 2026 says something about UEM platform lifespans
CVE-2021-22054 was originally published in December 2021 against VMware Workspace ONE UEM — the same product now under the Omnissa brand following VMware's UEM business changing hands. NVD's description states the SSRF vulnerability may allow "a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information," entirely unauthenticated. The more than four-year gap between original disclosure and this CVE's confirmed-exploited status added to KEV in March 2026 mirrors a pattern seen repeatedly across this series: enterprise management platforms with long deployment lifecycles and infrequent patch cycles carry old, well-documented vulnerabilities forward for years past their original disclosure, and eventually those vulnerabilities get rediscovered by attackers even after the original vendor advisory has aged out of most teams' active attention. A Unified Endpoint Management console is a uniquely valuable SSRF target regardless of CVE age, because it typically has privileged network reach into segments that individual managed devices cannot access directly — precisely the "sensitive information" access NVD's description references.
What to check this week
- Confirm Apex One (on-premise) administrative access is tightly restricted and monitored, since this vulnerability's real-world risk depends entirely on an attacker already holding admin credentials — the directory traversal itself is the second stage, not the first.
- Apply Trend Micro's fix referenced in KA-0023430 and review the specific key table this vulnerability targets for any signs of prior tampering if administrative compromise is suspected.
- Verify Workspace ONE UEM console version is current and not still running a build vulnerable to the 2021 SSRF flaw, given the multi-year gap between disclosure and confirmed exploitation shows this bug did not simply disappear from the exposed population.
- Audit UEM console network segmentation specifically for SSRF exposure — confirm the console cannot be coerced into making requests against internal services on the attacker's behalf, independent of whether this exact CVE is patched.
A closing note on why endpoint security and device management software isn't exempt from its own risk category
Both Apex One and Workspace ONE UEM exist to secure and manage the devices underneath them, yet both have now produced vulnerabilities that use that same privileged position against the fleet they administer. Security and management tooling sits at a structurally higher-trust point in the network than the devices it oversees, which means a vulnerability in either category deserves scrutiny at least equal to — arguably greater than — an equivalent bug in the endpoints themselves.
A final consideration on legacy branding complicating patch tracking
Workspace ONE UEM's transition from VMware branding to Omnissa branding is a reminder that vendor and product renames can create gaps in asset inventories built around a specific vendor name. Teams still tracking this product under "VMware" in their CMDB risk missing advisories and CVE associations published under the current "Omnissa" name, and vice versa.
How Safeguard helps
Safeguard's continuous inventory tracks endpoint security and device management platforms as the high-trust infrastructure they are, correlating vulnerabilities across vendor rebrands and legacy naming so a UEM console still catalogued under a prior vendor name doesn't fall outside active vulnerability tracking.
