Trend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security
CVE-2021-36742
Trend Micro Multiple Products Improper Input Validation Vulnerability
What it is
A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CISA: Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 17, 2021
More exploited flaws from Trend Micro
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Multiple Products Improper Input Validation | Apex One, Apex One as a Service, and Worry-Free Business Security | High 8.8 | 5.0% |
| May 21, 2026 | (On-Premise) Directory Traversal | Apex One | Medium 6.7 | 13% |
| Aug 18, 2025 | OS Command Injection | Apex One | Critical 9.4 | 25% |
| Sep 21, 2023 | Remote Code Execution | Apex One and Worry-Free Business Security | High 7.2 | 4.2% |
| Sep 15, 2022 | Improper Validation | Apex One and Apex One as a Service | High 7.2 | 3.4% |
| Mar 31, 2022 | Arbitrary File Upload | Apex Central | Critical 9.8 | 19% |
| Nov 3, 2021 | Remote Code Execution | Apex One and OfficeScan | High 8.8 | 11% |
| Nov 3, 2021 | Multiple Products Content Validation Escape | Apex One, OfficeScan and Worry-Free Business Security Agents | High 8.8 | 6.2% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.