CVE-2021-36741
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service,...
CVE-2021-36741 is a high vulnerability (CVSS 8.8) in Trend Micro Apex One, published July 29, 2021. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.95%, the 92nd percentile. No source names a fixed version.
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.
- Record
CVE-2021-36741- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.
- Record
CVE-2021-36741- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
EUVDEUVD-2021-23331
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.
- Record
EUVD-2021-23331- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7w3v-7x22-4g8v
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service,...
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations.
Please note: an attacker must first obtain the ability to logon to the product’s management console in order to exploit this vulnerability.
- Record
GHSA-7w3v-7x22-4g8v- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-434
- Updated
- 2026-11-02
CISA KEV No score
Trend Micro Multiple Products Improper Input Validation Vulnerability
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.
- Record
CVE-2021-36741- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
- trend micro apex one
- trend micro officescan
- trend micro worry-free business security
- trend micro apex one, apex one as a service, and worry-free business security
- trendmicro apex one
- trendmicro officescan
- trendmicro worry-free business security
- trendmicro officescan business security
- trend micro, inc. micro worry-free business security
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | exploitation | |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
References
success.trendmicro.com/solution/000287819
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36741
nvd.nist.gov/vuln/detail/CVE-2021-36741
github.com/advisories/GHSA-7w3v-7x22-4g8v