CVE-2021-36742

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Apex One	2019, SaaS
Trend Micro	Trend Micro OfficeScan	XG SP1
Trend Micro	Trend Micro Worry-Free Business Security	10.0 SP1

References

https://success.trendmicro.com/jp/solution/000287796Vendor Advisory
https://success.trendmicro.com/jp/solution/000287815Vendor Advisory
https://success.trendmicro.com/solution/000287819Vendor Advisory
https://success.trendmicro.com/solution/000287820Vendor Advisory
https://success.trendmicro.com/jp/solution/000287796Vendor Advisory
https://success.trendmicro.com/jp/solution/000287815Vendor Advisory
https://success.trendmicro.com/solution/000287819Vendor Advisory
https://success.trendmicro.com/solution/000287820Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36742US Government Resource

Timeline

Published: Jul 29, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-367447.8Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit CVE-2021-367459.8A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers CVE-2021-367465.4Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.CVE-2021-367475.4Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.CVE-2021-367487.5A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote a CVE-2021-367496.5In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows aut CVE-2021-36757.1Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrit CVE-2021-367508.1ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVau CVE-2021-367514.2ENC DataVault 7.2.3 and before, and OEM versions, use an encryption algorithm that is vulnerable to data manipulation (without knowledge of CVE-2021-367537.8sharkdp BAT before 0.18.2 executes less.exe from the current working directory.CVE-2021-367547.5PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes a CVE-2021-367556.1Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.