{"id":"CVE-2021-36741","kind":"vulnerability","aliases":["CVE-2021-36741"],"related":[],"title":"Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security: Trend Micro Multiple Products Improper Input Validation Vulnerability","description":"An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.","summary":"Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 have an input validation flaw that lets an attacker upload arbitrary files to the server. The attacker must first be able to log in to the product's management console, and CISA lists this as actively exploited.","severity":"high","cvss":8.8,"epss":0.04951,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apex-one","exploited","officescan","self-hosted","trend-micro","vendor","worry-free-business-security"],"not_affected_if":["no-management-console-access-exposed","not-trend-micro-endpoint"],"how_to_check":null,"fix":"Apply the Trend Micro patch for CVE-2021-36741 for your product; the sources do not name the fixed build number.","status":"open","published_at":"2021-07-29T20:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:37+00:00","updated_at":"2026-10-23T20:29:37+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:29:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Trend Micro patch for CVE-2021-36741 for your product; the sources do not name the fixed build number.","summary":"Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 have an input validation flaw that lets an attacker upload arbitrary files to the server. The attacker must first be able to log in to the product's management console, and CISA lists this as actively exploited.","category":"vendor","who_cares":["trend-micro","apex-one","officescan","worry-free-business-security","self-hosted"],"confidence":0.6,"analyst_note":"Find the fixed build numbers and the console-version check from Trend Micro's advisory for CVE-2021-36741, starting from the NVD page https://nvd.nist.gov/vuln/detail/CVE-2021-36741.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-trend-micro-endpoint","no-management-console-access-exposed"],"severity_if_unknown":"high"},"cost_usd":0.000403,"input_tokens":2197,"output_tokens":366,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2021':25A,28A '-36741':26A,29A '10.0':79B,141C 'a':37A 'abil':162C 'abl':101B 'activ':116B 'affect':152C 'allow':143C 'and':39A 'apex':3A,5A,32A,34A,46B,64B,66B,126C,128C 'apex-on':45B 'arbitrari':91B,149C 'as':36A 'attach':146C 'attack':89B,97B,157C 'busi':14A,60B,77B,139C 'business':43A 'cisa':112B 'consol':110B,170C 'cve':24A,27A 'exploit':48B,117B,174C 'file':92B,150C 'first':99B,159C 'flaw':85B 'free':13A,42A,59B,76B,138C 'host':52B 'improp':20A,119C 'input':21A,83B,120C 'instal':153C 'let':87B 'list':113B 'log':103B 'logon':164C 'manag':109B,169C 'micro':2A,17A,31A,55B,63B,125C 'multipl':18A 'must':98B,158C 'note':155C 'obtain':160C 'officescan':49B,71B,133C 'one':4A,6A,33A,35A,47B,65B,67B,127C,129C 'order':172C 'pleas':154C 'product':19A,107B,167C 'remot':145C 'secur':15A,61B,78B,140C 'security':44A 'self':51B 'self-host':50B 'server':95B 'servic':9A,70B,132C 'service':38A 'sp1':80B,142C 'trend':1A,16A,30A,54B,62B,124C 'trend-micro':53B 'upload':90B,148C 'valid':22A,84B,121C 'vendor':56B 'vulner':23A,122C,176C 'worri':12A,58B,75B,137C 'worry':41A 'worry-fre':11A,74B,136C 'worry-free':40A 'worry-free-business-secur':57B 'xg':72B,134C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-07-29T20:15:07+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-36741","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36741","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2021-36741","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-36741","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-36741","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36741","severity":null,"published_at":"2021-07-29T20:15:07+00:00","modified_at":"2026-06-17T03:59:05+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}