Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security
CVE-2021-36741
Trend Micro Multiple Products Improper Input Validation Vulnerability
What it is
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.
CISA: Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 17, 2021
More exploited flaws from Trend Micro
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Multiple Products Improper Input Validation | Apex One, Apex One as a Service, and Worry-Free Business Security | High 7.8 | 1.5% |
| May 21, 2026 | (On-Premise) Directory Traversal | Apex One | Medium 6.7 | 13% |
| Aug 18, 2025 | OS Command Injection | Apex One | Critical 9.4 | 25% |
| Sep 21, 2023 | Remote Code Execution | Apex One and Worry-Free Business Security | High 7.2 | 4.2% |
| Sep 15, 2022 | Improper Validation | Apex One and Apex One as a Service | High 7.2 | 3.4% |
| Mar 31, 2022 | Arbitrary File Upload | Apex Central | Critical 9.8 | 19% |
| Nov 3, 2021 | Remote Code Execution | Apex One and OfficeScan | High 8.8 | 11% |
| Nov 3, 2021 | Multiple Products Content Validation Escape | Apex One, OfficeScan and Worry-Free Business Security Agents | High 8.8 | 6.2% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.