CVE-2021-36741: high-severity vulnerability in Trend Micro Apex One
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
A flaw in Trend Micro security products allows someone with console access to upload any file they want, bypassing safety checks. This is dangerous because it can lead to installing malicious code on protected systems.
Improper input validation in file upload functionality allows authenticated users with management console access to bypass file type restrictions and upload arbitrary files. This can facilitate remote code execution or system compromise on affected Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 installations.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.