The following Python script is provided to scan, verify, or query the system telemetry:
#!/usr/bin/env python3
import csv
import json
import os
import re
import sys
from pathlib import Path
ASSET_EXPORT = Path(os.environ.get("ASSET_EXPORT", sys.argv[1] if len(sys.argv) > 1 else "apex-one-assets.csv")).resolve()
OUT = Path(os.environ.get("OUT", "hp-apex-one-cve-2026-34926-closure")).resolve()
CVE = "CVE-2026-34926"
SOURCE = "https://success.trendmicro.com/en-US/solution/KA-0023430"
def vt(value):
return tuple(int(x) for x in re.findall(r"\d+", str(value))[:5])
def ge(left, right):
l, r = vt(left), vt(right)
width = max(len(l), len(r), 1)
return l + (0,) * (width - len(l)) >= r + (0,) * (width - len(r))
def load_rows(path):
if not path.exists():
raise SystemExit(f"ASSET_EXPORT not found: {path}")
if path.suffix.lower() == ".csv":
with path.open(newline="", encoding="utf-8", errors="ignore") as handle:
return list(csv.DictReader(handle))
data = json.loads(path.read_text(encoding="utf-8", errors="ignore"))
return data if isinstance(data, list) else next((data[k] for k in ("assets", "agents", "servers", "findings", "rows") if isinstance(data.get(k), list)), [])
OUT.mkdir(parents=True, exist_ok=True)
results = []
for idx, row in enumerate(load_rows(ASSET_EXPORT), start=1):
text = json.dumps(row, sort_keys=True)
if "Apex One" not in text and "CVE-2026-34926" not in text:
continue
version = ""
match = re.search(r"(?<!\d)(14\.0\.\d+|\d{5})(?!\d)", text)
if match:
version = match.group(1)
fixed = False
if version.isdigit():
fixed = int(version) >= 17079 or int(version) >= 18012
elif version:
fixed = ge(version, "14.0.20731")
results.append({"row": idx, "cve": CVE, "source": SOURCE, "detected_build": version, "fixed_build_proven": fixed, "row_data": row})
(OUT / "apex-one-cve-2026-34926-build-verification.json").write_text(json.dumps(results, indent=2, sort_keys=True), encoding="utf-8")
# Remediation trigger: fixed_build_proven false for any Apex One server or agent row keeps CVE-2026-34926 open.
print(json.dumps({"out": str(OUT), "checked": len(results), "not_closed": [r for r in results if not r["fixed_build_proven"]]}, indent=2))