ZeroDay Findings
Sign inSign up

Findings

CVE-2021-36742

Trend Micro Multiple Products Improper Input Validation Vulnerability

Published Jul 29, 2021 · updated Jun 16, 2026 · trendmicro officescan

A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 29, 2021 · Catalog

    Detected

    A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Nov 17, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Required action

Apply updates per vendor instructions.

CISA due date Nov 17, 2021

Affected

  • cpe trendmicro/apex one2019
  • cpe trendmicro/officescanxg
  • cpe trendmicro/officescan business security10.0
  • cpe trendmicro/worry-free business security10.0
  • vendor Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Securityversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2021-36742

    Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2021-36742

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-36742

    30-day exploitation probability 1.5%

    first.org
  • NIST NVDVulnerability recordCVE-2021-36742

    A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to ex

    nvd.nist.gov

References