CVE-2021-36741

What it actually does

CVE-2021-36741 is an improper input validation flaw in the management-console functionality of Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1. A remote attacker with valid low-privileged console access can upload arbitrary files to an affected server. Depending on where the file is written and how the management server is configured, this can lead to web shell placement, execution of attacker-controlled code, modification of security-management content, data exposure, or disruption of the endpoint protection management plane. The CVSS vector indicates network reachability, low attack complexity, required authentication, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can turn the endpoint security management server into an attacker-controlled foothold. Because these products manage endpoint protection across many systems, compromise can undermine antivirus policy enforcement, enable broader internal movement, expose administrative data, and disrupt security operations. This vulnerability is listed in CISA Known Exploited Vulnerabilities with a remediation due date of 2021-11-17 and has been observed exploited in the wild, so unpatched systems should be treated as high priority even though authentication is required.

How an attack unfolds

An attacker first obtains credentials that allow access to the affected product management console, for example through phishing, credential theft, password reuse, or compromise of an existing administrator or operator account. After authenticating to the console, the attacker sends a crafted upload request that bypasses expected input validation and writes an attacker-controlled file to the server. If the uploaded file is placed in a web-accessible or executable location, the attacker can request that file through the management server and use it as a web shell or staging mechanism. From there, the attacker may execute commands in the context of the web or application service account, collect configuration and credential material, tamper with endpoint security policies, disable protections, or use the server as a pivot point into managed Windows environments.

How to fix it

Upgrade or patch all affected Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 deployments using the vendor-provided fixes and hotfixes applicable to the installed product and build. Where exact fixed versions are not centrally available, verify directly against Trend Micro security advisories and product support portals for the corrected build level. Restrict management-console access to trusted administrative networks or VPNs, enforce multifactor authentication where supported, review and reduce console privileges, rotate potentially exposed console credentials, and remove unnecessary accounts. If immediate patching is not possible, place the console behind network access controls, block internet exposure, monitor upload functionality closely, and consider temporarily disabling externally reachable administrative access until remediation is complete.

How to confirm the fix worked

Confirm the installed product version and build against Trend Micro’s advisory for this vulnerability and verify that the relevant hotfix or patched build is installed. From a network perspective, confirm that the management console is not reachable from untrusted networks and that access is limited to authorized administrative sources. Review the server file system for unexpected files created after suspicious console logins, especially in web-accessible directories under the product installation path. Validate that low-privileged console users cannot upload files outside intended locations or upload executable server-side content. After patching, repeat authenticated testing in a controlled manner to ensure crafted upload attempts are rejected or sanitized.

Typical attack path

1. Acquire valid credentials for the Trend Micro product management console.
2. Authenticate remotely to the affected management interface.
3. Submit a crafted file-upload request that abuses improper input validation.
4. Write an attacker-controlled file to a server-side location.
5. Invoke the uploaded file if it is web-accessible or otherwise executable.
6. Use the resulting foothold to run commands, stage tools, alter security policies, collect sensitive data, or move laterally.

How to detect it

Investigate authentication and web access logs for successful console logins followed by unusual upload requests, especially from unfamiliar IP addresses, unexpected geographies, VPN exits, or accounts that do not normally perform administration. Correlate management-console activity with file creation events on the Trend Micro server, focusing on new scripts, binaries, archives, or unusually named files in product web directories. On Windows servers, review Security Event Log process creation events if enabled, Sysmon Event ID 1, file creation events such as Sysmon Event ID 11, IIS or web server logs, Trend Micro product logs, and EDR telemetry. Look for web server or application service processes spawning command interpreters, scripting engines, compression utilities, reconnaissance commands, or network tools. Because exploitation requires authentication, also investigate credential theft indicators, impossible travel, repeated failed logins before success, new console users, privilege changes, and policy tampering. Treat unexpected files created under Trend Micro OfficeScan/Apex One web or PCCSRV directories as suspicious until proven legitimate.

• C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Web\*.aspx
• C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Web\*.asp
• C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Web\*.jsp
• C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Web\*.php
• C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\*.aspx
• C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\*.asp
• C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\*.jsp
• C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\*.php
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user
• cmd.exe /c net localgroup
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin.exe /transfer
• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• httpd.exe -> cmd.exe
• httpd.exe -> powershell.exe

What your security team should do

• Immediately identify all internet-facing or broadly reachable Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security management consoles.
• Prioritize patching because this vulnerability is in CISA KEV, was actively exploited in the wild, and the KEV remediation deadline has long passed.
• Restrict console access to dedicated administrative networks, VPNs, or jump hosts; block direct public access wherever possible.
• Audit management-console accounts, remove stale users, enforce strong authentication, and rotate credentials for privileged and recently used accounts.
• Review recent console login history and file-upload activity for anomalous source IPs, unusual times, or low-privileged users performing administrative actions.
• Hunt for unexpected executable or script files in Trend Micro product web and server directories, especially files created around suspicious login events.
• If suspicious files or activity are found, isolate the management server, preserve forensic evidence, rotate secrets, rebuild if necessary, and assess managed endpoints for downstream compromise.