HackerFeeds
All CVEs

CVE-2021-36741

HIGH8.8
CISA KEV

Published 2021-07-29 · Updated 2026-06-17 · Source security@trendmicro.com

Summary

CVE-2021-36741 is a high-severity (CVSS 8.8) vulnerability in Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 17, 2021. CISA does not currently list it as used in ransomware campaigns. Trend Micro has 12 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 12 known-exploited Trend Micro vulnerabilities →

Description

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-434CWE-434

CISA Known-Exploited Vulnerability

Product: Trend Micro — Apex One, Apex One as a Service, and Worry-Free Business Security

Name: Trend Micro Multiple Products Improper Input Validation Vulnerability

Date added: 2021-11-03 · Due: 2021-11-17

Required action: Apply updates per vendor instructions.

References

View on NVD