---
id: "CVE-2021-36741"
kind: "vulnerability"
aliases: ["CVE-2021-36741"]
title: "Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security: Trend Micro Multiple Products Improper Input Validation Vulnerability"
severity: "high"
cvss: 8.8
epss: 0.04951
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apex-one", "exploited", "officescan", "self-hosted", "trend-micro", "vendor", "worry-free-business-security"]
not_affected_if: ["no-management-console-access-exposed", "not-trend-micro-endpoint"]
published_at: "2021-07-29T20:15:07+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:29:37+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36741", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-36741", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36741", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security: Trend Micro Multiple Products Improper Input Validation Vulnerability

Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 have an input validation flaw that lets an attacker upload arbitrary files to the server. The attacker must first be able to log in to the product's management console, and CISA lists this as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security affected ? fixed ?

## Fix

Apply the Trend Micro patch for CVE-2021-36741 for your product; the sources do not name the fixed build number.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36741
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-36741
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-36741

## From the sources

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_