How to Fix CVE-2021-36742: Security Vulnerability in Trend Micro Apex One, Trend Micro OfficeScan, Trend Micro Worry-Free Business Security

By Sai Kiran Pandrala

Patch immediately. Actively exploited. CISA listed this in the Known Exploited Vulnerabilities catalog on 2021-11-03. Federal due date: 2021-11-17. Treat any internet-exposed instance as a priority patch.

What is CVE-2021-36742?

CVE-2021-36742 is a security vulnerability issue affecting Trend Micro Apex One, Trend Micro OfficeScan, Trend Micro Worry-Free Business Security disclosed on 2021-07-29. Successful exploitation gives an attacker access or capabilities beyond what the application's design intends. CISA notes this CVE has been used in real-world attacks.

The technical detail from the advisory: A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.

Why this matters

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2021-11-03. That listing exists because at least one confirmed in-the-wild exploitation report was filed. Federal civilian agencies are bound by BOD 22-01 to patch by 2021-11-17, and most enterprises treat that timeline as a practical floor. Opportunistic scanning for known-exploited CVEs runs continuously across the public internet, so any unpatched exposed instance is on borrowed time.

The blast radius depends on how the affected service is exposed. An internet-reachable instance with no compensating controls is the highest-risk configuration. An internal-only instance behind authenticated VPN is lower risk but still requires the patch.

Am I affected?

You are affected if you run a version listed in the Affected row above. Check your installed build of Trend Micro Apex One, Trend Micro OfficeScan, Trend Micro Worry-Free Business Security against that list. If your version sits at or below the affected range and you have not applied the vendor patch noted in the Fixed in row, you are vulnerable.

For internet-facing or business-critical instances, treat this as exposure until proven otherwise. Run an asset inventory to find every install of Trend Micro Apex One, Trend Micro OfficeScan, Trend Micro Worry-Free Business Security, including secondary or dev/test environments that may have been deployed and forgotten.

How to fix CVE-2021-36742

1. Read the official vendor advisory linked in References below. It carries the authoritative list of patched builds and any product-specific upgrade notes.
2. Inventory affected hosts before touching anything. Know how many instances you have, which are exposed, and which are HA-paired.
3. Take a configuration backup of the affected device or application.
4. Apply the patched build named in the Fixed in row. For HA pairs, patch the standby first, fail over, then patch the former primary.
5. Restart the service or device if the vendor procedure requires it.
6. Confirm the new version is running (see verification section).

1. Hunt for prior compromise. Because this CVE is in the CISA KEV catalog, assume opportunistic scanning has already touched any exposed instance. Review authentication logs, look for unfamiliar accounts, and check for unexpected processes or scheduled tasks.

Apply the Microsoft security update

# The exact KB number is listed in the Microsoft advisory: https://success.trendmicro.com/solution/000287819
# Confirm the patch is missing on this host
Get-Hotfix -Id <KB-from-advisory> -ErrorAction SilentlyContinue

# Install the rollup that ships the fix
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Import-Module PSWindowsUpdate
Get-WindowsUpdate -KBArticleID <KB-from-advisory> -AcceptAll -Install -AutoReboot

# Verify the patch is now present
Get-Hotfix -Id <KB-from-advisory>

# Inventory missing patches across a Windows fleet via Ansible (winrm)
ansible windows -m win_updates -a "category_names=SecurityUpdates state=installed"

Verify the fix landed

# 1. Confirm the running version matches the fixed-in version from the advisory:
#    https://success.trendmicro.com/solution/000287819
#    Use the platform-specific version probe above.

# 2. Re-scan with your vulnerability scanner (Nessus, Qualys, Tenable, OpenVAS).
#    The scanner should no longer flag CVE-2021-36742 on the patched target.

# 3. Inspect recent service / kernel logs for crash loops or rollback events.
journalctl -u <service> --since "10 minutes ago"
dmesg --since "10 minutes ago"

If you can't patch immediately

Apply vendor-published mitigations only. Common interim steps:

• Restrict network exposure. Place the vulnerable service behind a VPN or block external access at the perimeter firewall.
• Disable the affected feature if the vendor advisory documents a safe way to do so.
• Increase monitoring on the affected service. Alert on any successful authentication or unusual request pattern.

If the vendor advisory does not list a workaround, none has been validated. Patching is the only remediation in that case.

How to verify the fix worked

1. Check the running version of Trend Micro Apex One, Trend Micro OfficeScan, Trend Micro Worry-Free Business Security matches a build named in the Fixed in row.
2. Re-run your vulnerability scanner against the host. The CVE should no longer flag.
3. If you applied mitigations instead of a patch, confirm those controls are still in place after the next reboot or configuration change.
4. Review logs from the exposure window. Anything anomalous needs an incident-response review, not a passive note.

Frequently asked questions

Related fixes

Other vulnerabilities in the same area that are worth patching alongside this one:

• How to Fix CVE-2021-21315: OS Command Injection in Sebhildebrandt systeminformation — OS Command Injection in Sebhildebrandt systeminformation
• How to Fix CVE-2021-26828: Security Vulnerability in OpenPLC ScadaBR through — Security Vulnerability in OpenPLC ScadaBR through
• How to Fix CVE-2021-44207: Security Vulnerability in Acclaim USAHERDS through , Security Vulnerability in Acclaim USAHERDS through
• How to Fix CVE-2021-27860: Critical Vulnerability in WARP , Critical Vulnerability in WARP
• How to Fix CVE-2021-33044: Authentication Bypass in Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices , Authentication Bypass in Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices

Is this CVE being exploited in the wild?

Yes. CISA added CVE-2021-36742 to the Known Exploited Vulnerabilities catalog on 2021-11-03, which means at least one confirmed real-world exploitation report exists.

Do I need to take the system offline to patch?

That depends on the vendor's upgrade procedure for Trend Micro Apex One, Trend Micro OfficeScan, Trend Micro Worry-Free Business Security. For HA-paired devices and clustered software, the standard pattern is to patch the standby instance first, fail over, and then patch the former primary. Read the vendor advisory for the exact steps.

Will my vendor support contract cover the patched build?

If your installation is on a supported release line, the patched build is usually a free upgrade. End-of-life or end-of-support builds may require a paid migration to a supported major version.

References

• Official vendor advisory: https://success.trendmicro.com/solution/000287819
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-36742
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV entry: "Trend Micro Multiple Products Improper Input Validation Vulnerability" - added 2021-11-03

*Assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.*