CVE-2021-36741: Trend Micro Apex One and OfficeScan unrestricted file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed exploitation and a high CVSS of 8.8, though it requires valid console credentials, which limits reach.

What it is

Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 fail to properly validate input, allowing an authenticated user to upload arbitrary files. Because these are endpoint security management consoles, a successful upload can undermine the very platform used to protect the estate.

Impact

An attacker with console access can place arbitrary files on the server, which can lead to code execution or full compromise of the management host and the endpoints it controls. CVSS 3.1 scores this 8.8 (HIGH) with high confidentiality, integrity and availability impact.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires valid credentials to the product's management console (PR:L). The flaw is in the console's file upload handling.

Exploitation

It is listed in CISA's Known Exploited Vulnerabilities catalog with a 2021-11-03 addition and 2021-11-17 remediation due date, indicating real-world exploitation; EPSS 30-day probability is about 5.0 percent (91.7th percentile). No ransomware campaign use is recorded.

What to do

• Apply the vendor updates referenced in the Trend Micro advisories for Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1.
• Restrict management console access to trusted administrative networks and remove or disable unused console accounts.
• Enforce strong authentication and unique credentials for console administrators; audit for shared or default accounts.
• Monitor and alert on unexpected file writes or new executables in the console's web and upload directories.
• If patching cannot be completed immediately, isolate the management server from untrusted networks and limit who can log on.

Detection

• Review management console authentication logs for logons from unusual source IPs or at unusual times preceding file upload activity.
• Monitor the console's web and upload directories for newly created files, especially executables, scripts or web shells.
• Alert on unexpected outbound connections or child processes spawned by the management console service.
• Correlate file creation events on the management server with console session activity to identify uploads outside normal administrative change windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.