CVE-2021-36742

What it actually does

This is a local privilege-escalation vulnerability caused by improper input validation in Trend Micro endpoint security products on Windows, including Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1. An attacker who can already run low-privileged code on an affected endpoint can abuse a privileged Trend Micro component or service to execute attacker-controlled actions with elevated privileges, typically SYSTEM-level rights. Successful exploitation can allow full compromise of confidentiality, integrity, and availability on the local host, including disabling endpoint protection, modifying protected files or registry settings, credential access, persistence, and lateral-movement preparation.

Why it matters to the business

Because the vulnerable software is endpoint security tooling, exploitation can let an intruder turn a foothold on a workstation or server into administrative control while weakening or disabling the same defensive product meant to stop them. This vulnerability is listed in CISA KEV, has been observed exploited in the wild, and had a federal remediation deadline of 2021-11-17, so unpatched deployments should be treated as high-priority legacy exposure even though the EPSS score is relatively low. Operational consequences include endpoint takeover, security-tool tampering, data theft, ransomware staging, and expansion from a single compromised user context to broader Windows domain compromise.

How an attack unfolds

An attacker first obtains the ability to execute code as a normal, low-privileged Windows user on a system running a vulnerable Trend Micro endpoint agent. They then interact locally with the vulnerable Trend Micro component using crafted input that is not properly validated. Because the targeted component runs with elevated privileges, the attacker can cause privileged actions to occur on their behalf. After elevation, the attacker commonly validates SYSTEM or administrator privileges, disables or alters security controls, creates persistence such as a service or scheduled task, dumps credentials, and uses the compromised endpoint as a staging point for lateral movement. Public reporting and KEV status indicate exploitation has occurred in the wild, so detection should focus not only on the exploit trigger but also on post-exploitation behaviors around Trend Micro processes and Windows privilege escalation events.

How to fix it

Upgrade affected Trend Micro products to vendor-fixed builds or the latest supported versions for Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1. Because no exact fixed versions were provided in the input, use Trend Micro’s advisory and product console to identify the applicable critical patch, hotfix, service pack, or current supported release for each deployed product. Remove or replace end-of-life OfficeScan and older Worry-Free Business Security installations where patches are no longer available. Until patching is complete, reduce exposure by limiting interactive logon to endpoints, enforcing least privilege, blocking untrusted script execution, monitoring and preventing tampering with Trend Micro services, and ensuring endpoint protection self-defense features are enabled. Treat systems with evidence of exploitation as compromised and perform incident response rather than only patching.

How to confirm the fix worked

Confirm the installed Trend Micro product name, build, service pack, hotfix, and agent version from the management console and locally on Windows endpoints, then compare them with Trend Micro’s fixed release guidance for this vulnerability. Validate that endpoints have successfully received the patched agent and that vulnerable OfficeScan XG, Apex One, Apex One as a Service, or Worry-Free Business Security 10.0 SP1 builds are no longer present. Verify Trend Micro services are running normally after the update and that self-protection features remain enabled. Run authenticated vulnerability scans or endpoint inventory checks to find remaining vulnerable agents. Where feasible, conduct controlled regression testing using vendor-approved validation steps only; do not run public exploit code on production systems.

Typical attack path

1. Gain initial low-privileged code execution on a Windows endpoint through phishing, malware, stolen credentials, or another vulnerability.
2. Confirm the endpoint is running an affected Trend Micro product such as Apex One, OfficeScan XG, or Worry-Free Business Security.
3. Submit crafted local input to the vulnerable Trend Micro component or service.
4. Abuse the privileged service context to execute code or perform actions with elevated privileges.
5. Validate elevated access, often by checking token privileges, group membership, or SYSTEM context.
6. Disable, bypass, or tamper with endpoint security controls to reduce detection.
7. Establish persistence through a new service, scheduled task, startup item, or modified registry setting.
8. Perform credential access, discovery, lateral movement, data theft, or ransomware staging.

How to detect it

There is unlikely to be a reliable network-only signature because exploitation is local and requires prior code execution. Use EDR, Windows Security logs, Sysmon, Windows System logs, Task Scheduler logs, service-control logs, and Trend Micro agent/server logs to hunt for suspicious activity before and after privilege elevation. Key sources include Windows Security Event IDs 4688 for process creation, 4624 for logon activity, 4672 for special privileges assigned, 4688 or Sysmon Event ID 1 for command execution, 7045 for new service installation, 7031 and 7036 for service crashes or state changes, 4698 for scheduled task creation, and 4720, 4728, or 4732 for local/domain account or group changes. Look for low-privileged users interacting with Trend Micro binaries or services followed by SYSTEM-level shells, PowerShell, WMI, PsExec-like tools, credential-access tooling, or changes to endpoint protection settings. Review Trend Micro product logs for service restarts, abnormal agent behavior, component crashes, policy changes, tamper-protection events, disabled real-time scanning, or failed integrity checks. Give special attention to endpoints that were vulnerable before the KEV remediation deadline, endpoints with old OfficeScan or Worry-Free agents, and systems where Trend Micro processes spawn unusual child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, mshta.exe, certutil.exe, bitsadmin.exe, wmic.exe, or net.exe.

• ParentImage:*\\Trend Micro\\* AND Image:*\\cmd.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\powershell.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\pwsh.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\wscript.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\cscript.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\mshta.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\rundll32.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\regsvr32.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\wmic.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\certutil.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\bitsadmin.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\net.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\net1.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\sc.exe
• ParentImage:*\\Trend Micro\\* AND Image:*\\schtasks.exe
• C:\\Program Files (x86)\\Trend Micro\\OfficeScan Client\\
• C:\\Program Files\\Trend Micro\\OfficeScan Client\\
• C:\\Program Files (x86)\\Trend Micro\\Security Agent\\
• C:\\Program Files\\Trend Micro\\Security Agent\\
• C:\\Program Files (x86)\\Trend Micro\\Apex One\\
• C:\\Program Files\\Trend Micro\\Apex One\\
• NTRtScan.exe
• PccNTMon.exe
• TmListen.exe
• TmProxy.exe
• TmCCSF.exe
• PccNTUpd.exe
• TMBMSRV.exe
• EventCode=7045 AND (Service_File_Name=*\\Trend Micro\\* OR Service_Name=*Trend*)
• EventCode=7031 AND Service_Name=*Trend*
• EventCode=7036 AND Service_Name=*Trend*
• EventCode=4698 AND TaskContent=*\\Trend Micro\\*
• whoami /priv
• net localgroup administrators
• sc stop TmListen
• sc stop NTRtScan
• taskkill /IM NTRtScan.exe
• taskkill /IM PccNTMon.exe

What your security team should do

• Prioritize immediate patch verification for all Trend Micro endpoint security deployments because this vulnerability is in CISA KEV and is known to have been exploited in the wild.
• Inventory all Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 installations, including unmanaged or legacy agents.
• Upgrade affected products to Trend Micro fixed builds or latest supported versions; retire unsupported OfficeScan and older Worry-Free deployments.
• Hunt for local privilege-escalation and security-tool tampering activity on systems that were vulnerable before remediation.
• Review Windows event logs, EDR telemetry, and Trend Micro product logs for suspicious process creation, service creation, scheduled task creation, endpoint protection disablement, or SYSTEM-level execution following low-privileged user activity.
• Investigate any Trend Micro process spawning command shells, scripting engines, credential-dumping tools, or administrative utilities.
• Enforce least privilege and remove unnecessary local administrator rights to reduce the value of local privilege-escalation vulnerabilities.
• Enable tamper protection, application control, script control, and alerting for changes to endpoint security services.
• If exploitation is suspected, isolate the endpoint, collect forensic artifacts, rotate credentials used on the host, and assess for lateral movement.