CVE-2021-36741· NVD / CVE Program· CNA trendmicro

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 1

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.

HighCVSS 8.8 · v3.1KEVWeaponized No fix recorded

File upload

BDU:2021-04196

Noroxi analysis

No Noroxi analysis for this record yet

We don't hand-write analysis for the hundreds of thousands of vulnerabilities in the database; that wouldn't be honest. For notable, high-impact vulnerabilities our team writes the mechanism, detection and remediation steps.

We use this product, ask for help

Published: Jul 29, 2021
Updated: Jun 16, 2026
EPSS: 5.0% · 92th percentile
CWE: CWE-434

Follow this CVE

Report tools

JSON

Action score

This week

Don’t wait for the next maintenance window.

CVSS: 35 / 40 · 8.8 / 10
CISA KEV: 30 / 30 · Listed
EPSS: 1 / 30 · 5.0%

CISA SSVC decision

Exploitation: active
Automatable: no
Technical impact: total

Vulnrichment: CISA's decision-tree inputs.

Actively exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on Nov 3, 2021. That signals real attacks, not theory.

Remediation deadline for government agencies: Nov 17, 2021.

Affected systems

Vendor	Product	CPE
trendmicro	officescan	cpe:2.3:a:trendmicro:officescan
trendmicro	officescan business security	cpe:2.3:a:trendmicro:officescan_business_security
trendmicro	apex one	cpe:2.3:a:trendmicro:apex_one
trendmicro	worry-free business security	cpe:2.3:a:trendmicro:worry-free_business_security
microsoft	windows	cpe:2.3:o:microsoft:windows

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

trendmicro apex one2019
trendmicro officescanxg
trendmicro officescan business security10.0
trendmicro worry-free business security10.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (trendmicro). Independent of NVD's CPE analysis and usually ahead of it.

Trend Micro Trend Micro Apex One
- 2019, SaaSaffected
Trend Micro Trend Micro OfficeScan
- XG SP1affected
Trend Micro Trend Micro Worry-Free Business Security
- 10.0 SP1affected

Same product

trendmicro: all records

Other highest-scoring records for the same primary product.

CVE-2019-18187Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extracKEV
68This week
CVE-2021-36742A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.KEV
61This week
CVE-2017-11394Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerab
59Plan
CVE-2017-11393Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerab
44Plan
CVE-2017-14089An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated users who can access
42Plan
CVE-2017-5481Trend Micro OfficeScan 11.0 before SP1 CP 6325 and XG before CP 1352 allows remote authenticated users to gain privileges by leveraging a le
36Monitor

Remediation

Which version to upgrade to

Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.

No fix version is recorded for this entry. Check the references for vendor advisories.

Exploit status

Weaponized

A ready exploit tool or active in-the-wild use is known for this vulnerability. This should be your top priority.

Research context

For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.

Timeline

From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.

PublishedJul 29, 2021
CISA KEVNov 3, 2021+96 d
TodaySep 30, 2026+1889 d

EPSS, last 120 days

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Patch and commit links

Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.

No commit or PR link among the references.

Credits

All researchers

Finders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.

No credits in the CNA record.

Variant candidates

Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.

No nightly-computed relations.

Chain candidates

An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.

—

Bug bounty scope

No known public program.

Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).