The US Cybersecurity and Infrastructure Security Agency (CISA) has added a new high-severity vulnerability being actively-exploited in-the-wild to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, patched on September 13, 2022, affects products manufactured by the Trend Micro cybersecurity platform. The addition of this bug to the KEV requires all federal civilian executive branch (FCEB) agencies to patch the flaw no later than October 5, 2022, in accordance with Binding Operational Directive 22-01 (BOD 22-01). Failure of FCEB agencies to comply by the deadline will lead to hefty fines against the delinquent organizations. The vulnerability, tracked as CVE-2022-40139, exists in the Trend Micro Apex One and Trend Micro Apex One as a Service clients, and could be exploited by malicious threat actors to conduct arbitrary remote code execution (RCE) against vulnerable Apex One clients. Apex One is an automated endpoint security platform that provides threat detection and response for businesses employing the framework. In Trend Micro’s security advisory, it explains that “Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a[n] Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution.” Specific details about the vulnerability have not yet been published, as it is currently still undergoing analysis. Although dangerous enough to be added to the KEV, the flaw only received a CVSS score of 8.2/10, due to the fact that successful exploitation would require an attacker to first have access to the Apex One server administration console. Trend Micro stated that it has already “observed at least one active attempt of potential exploitation of this vulnerability in the wild.” CTIX analysts recommend organizations utilizing Apex One update their infrastructure immediately. Details regarding all of the vulnerabilities added to the KEV can be found in the KEV catalog linked below.