Antivirus software firm Trend Micro has patched a critical arbitrary file upload vulnerability affecting the Apex Central web-based management console, that if exploited could allow attackers to perform remote code execution (RCE). Apex Central offers administrators and security personnel the ability to manage their Trend Micro frameworks and tools from a single console. The vulnerability, tracked as CVE-2022-26871, stems from a weakness in the file handling module and has been exploited In-the-Wild, according to a Trend Micro spokesperson. Details of the successful exploits will not be disclosed at this time due to the confidential nature of their customers, so the full extent of the impact of this flaw won’t be known until that information is made public. The Cybersecurity and Infrastructure Security Agency (CISA) has released an order stating that all federal civilian agencies have until April 21, 2022, to patch their systems, or face fines for failing to do so. The Ankura CTIX also recommends that private users of Trend Micro antivirus patch their vulnerable products, to decrease their exposure to active exploitation as threat actors look for attack vectors and potential victims.