Two vulnerabilities landed on CISA’s Known Exploited list on 21 May. Federal agencies have until 4 June to remediate. Both deserve attention, but for different reasons, and the Apex One flaw in particular should be uncomfortable reading for anyone running that platform at enterprise scale.
Your endpoint security tool as the attack vector
CVE-2026-34926 affects Trend Micro Apex One On-Premise (2019 builds below 17079). The mechanics: a directory traversal flaw lets an attacker with local access manipulate file paths and write to a key configuration table on the management server. Once that table is poisoned, the server does what it’s designed to do: it pushes the content out to every agent in the managed fleet.
That’s the part worth sitting with. One server-side exploitation point. Simultaneous code execution on every endpoint Apex One manages. The security tooling becomes the propagation mechanism.
CISA’s KEV confirmation means this isn’t theoretical. Someone is already using it. Apex One is widely deployed across financial services, healthcare, telecoms, and government: organisations with exactly the kind of large, centrally managed endpoint estates that make this flaw operationally significant rather than merely interesting.
Patch to build 17079. If your maintenance windows don’t allow immediate patching, apply the vendor’s traversal path workarounds as a stopgap and isolate the management server from untrusted segments. Then review agent update logs from the past 30 days. Anomalous configuration changes to management tables are your primary forensic signal.
MuddyWater and the AI workflow attack surface
CVE-2025-34291 is the second addition. Langflow, an AI agent and workflow orchestration platform, has an origin validation flaw: overly permissive CORS settings combined with SameSite=None authentication cookies. A malicious page can make authenticated requests on behalf of a logged-in user. Since Langflow can execute workflow components, account takeover here means arbitrary code execution in the context of the platform.
MuddyWater, Iran’s MOIS-linked APT, has been exploiting this for initial access. The group has been active across Europe and the Middle East this year, occasionally deploying ransomware to obscure the underlying intelligence collection. The target set tracks with their persistent interests: think tanks, government contractors, critical infrastructure operators.
The harder problem with Langflow is what it’s connected to. Enterprise deployments routinely give workflow orchestration platforms privileged access to internal APIs, data repositories, calendar systems, productivity tooling. Lateral movement through a compromised Langflow instance can be hard to see; it looks like the platform doing its job, not an attacker pivoting.
The sectors that should be moving on this now
Financial services and professional services teams running AI workflow automation need to find their Langflow instances, including the ones data science teams spun up without going through security review. Every shadow IT deployment of Langflow is an MuddyWater-shaped problem waiting to happen.
Healthcare and critical infrastructure operators running Apex One at scale face the more immediate risk. The update channel that normally protects endpoints is the attack surface here. Standard network monitoring won’t catch it: traffic from the management server to agents is expected, trusted, and noisy.
What to do
Apex One (CVE-2026-34926):
- Update to server build 17079 now, not at the next maintenance window
- If patching is delayed, apply vendor workarounds and pull the management server back from untrusted network segments
- Pull deployment logs from the past 30 days and look for unexpected configuration changes to management tables
Langflow (CVE-2025-34291):
- Find every Langflow deployment, including the ones you don’t officially know about
- Patch. If that’s delayed, restrict to internal networks and require VPN for all access
- Scope down Langflow service account permissions, as it almost certainly has access to more than it needs
- Review auth logs for anomalous cross-origin requests or unexpected API calls from Langflow service accounts
Federal deadline is 4 June. Private sector organisations have no formal obligation to match it, but the threat actors aren’t making that distinction.