CVE-2021-36742: Trend Micro Apex One and OfficeScan improper input validation privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCVSS 7.8 and confirmed CISA KEV exploitation make this a high priority, tempered by the local, low-privilege prerequisite and low EPSS probability.

What it is

Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 contain an improper input validation flaw (CWE-20) that lets a local attacker escalate privileges. The record does not specify the vulnerable component or affected version ranges, only that low-privileged code execution is a prerequisite. It matters because the affected products are endpoint security agents, so a local escalation can undermine the protection layer itself.

Impact

An attacker who already runs low-privileged code can escalate to higher privileges on the host, gaining the level of access the vulnerable component runs under. The record does not state whether that reaches SYSTEM, so the exact ceiling is unconfirmed.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have a foothold on the endpoint. It is not remotely reachable and no authentication beyond that existing local access is described.

Exploitation

CVE-2021-36742 is listed in CISA KEV with a 2021-11-03 addition and 2021-11-17 due date, indicating known exploitation, though the record does not describe the campaigns. EPSS 30-day probability is 0.01482 (72.7th percentile), and no ransomware use is documented.

What to do

• Apply the vendor updates referenced in the Trend Micro advisories for Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1.
• Treat the KEV due date as passed and verify patching across all listed products, including agents that may be offline or unmanaged.
• Restrict and monitor who can execute code locally on endpoints running these agents, since exploitation requires an existing low-privileged foothold.
• Review endpoint agent versions against the vendor advisories to confirm no unsupported or end-of-life builds remain in the estate.

Detection

• Hunt for unexpected privilege changes or processes spawning from the endpoint security agent service context on hosts running the affected products.
• Monitor for local privilege escalation behavior on endpoints with these agents, correlating low-privileged process activity with later high-privilege actions.
• Alert on tampering or abnormal input handling around the Trend Micro agent processes, and track agent version compliance to spot unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.