Security readout for executives and security teams
Plain-English summary
This vulnerability can let an attacker who already has limited code execution on an affected endpoint gain higher privileges. It affects several Trend Micro endpoint security products, so compromise could weaken a control that is meant to protect workstations and servers.
Executive priority
High priority. This is not a remote initial-access flaw, but it is known exploited and can help an attacker turn limited endpoint access into deeper control. Remediate affected Trend Micro installations promptly.
Technical view
CVE-2021-36742 is an improper input validation issue (CWE-20) in Trend Micro Apex One, Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1. CVSS 3.1 is 7.8, local attack vector, low complexity, low privileges required, no user interaction, with high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on endpoints or servers running the listed Trend Micro products and versions. The attacker must already be able to execute low-privileged code locally, so this is mainly a post-compromise privilege escalation risk.
Exploitation context
CISA lists this CVE in the Known Exploited Vulnerabilities catalog, supporting known exploitation. The source bundle does not provide exploit mechanics, public exploit details, or indicators of compromise. Treat it as a real-world exploited local privilege escalation issue.
Researcher notes
The available evidence supports a local privilege escalation caused by improper input validation. The bundle does not name fixed build numbers, affected components, exploit prerequisites beyond low-privileged code execution, or concrete IOCs. Validation should focus on version exposure, advisory status, and endpoint telemetry.
Mitigation direction
- Review the linked Trend Micro advisories for product-specific remediation guidance.
- Apply vendor-recommended updates or mitigations for affected Trend Micro products.
- Prioritize systems where Trend Micro runs on endpoints with broad user access.
- Restrict low-privileged local code execution paths where operationally feasible.
- Monitor vendor and CISA guidance for updated remediation details.
Validation and detection
- Inventory systems running Apex One 2019 or Apex One as a Service.
- Identify OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 deployments.
- Confirm whether Trend Micro advisory remediation has been applied.
- Review endpoint security logs for suspicious privilege escalation activity.
- Check vulnerability management tools for CVE-2021-36742 detection coverage.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-36742 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://success.trendmicro.com/solution/000287819CVE reference · x_refsource_MISC
- https://success.trendmicro.com/solution/000287820CVE reference · x_refsource_MISC
- https://success.trendmicro.com/jp/solution/000287796CVE reference · x_refsource_MISC
- https://success.trendmicro.com/jp/solution/000287815CVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36742CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.