What is CVE-2022-41746?

CVE-2022-41746 is a critical-severity vulnerability in Microsoft Windows, classified under Direct Request (Forced Browsing). CVSS score: 9.1/10. Published 2022-10-10.

How severe is CVE-2022-41746?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Microsoft Windows

CVE-2022-41746

A forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to the Apex One console on affected installations to escalate privileges and modify certain agent groupings. Please note: an attacker must first ob…

EPSS: 0.010 (58.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Microsoft Windows
Trend Micro Apex One — versions 2019 (on-prem) and SaaS
Trendmicro Apex_one — versions 2019

Weakness classification (CWE)

CWE-425 — Direct Request (Forced Browsing)

References

security@trendmicro.com (Patch, Vendor Advisory)
security@trendmicro.com (VDB Entry, Third Party Advisory)

Frequently asked questions

What is CVE-2022-41746?: CVE-2022-41746 is a critical-severity vulnerability in Microsoft Windows, classified under Direct Request (Forced Browsing). CVSS score: 9.1/10. Published 2022-10-10.
How severe is CVE-2022-41746?: Critical severity. CVSS v3 base score is 9.1 out of 10.