CVE‑2021‑36741: Improper Input Validation in Trend Micro Apex One Enables Remote File Upload
What It Is – Trend Micro’s Apex One, Apex One as a Service, and Worry‑Free Business Security contain an input‑validation flaw that permits an unauthenticated remote attacker to upload arbitrary files to the server. The issue stems from insufficient sanitisation of file‑upload parameters.
Exploitability – No public exploit code has been released, but the vulnerability is rated CVSS 3.1 7.5 (High) and can be weaponised by an attacker who can reach the vulnerable endpoint.
Affected Products – Trend Micro Apex One (on‑premise), Apex One as a Service, and Trend Micro Worry‑Free Business Security.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for secure configuration and input‑validation controls that map to multiple compliance regimes (e.g., NIST CSF 2.0 Protect).
- Continuous monitoring of file‑upload activity provides defensible audit evidence that the control is operating as intended.
- A documented remediation path (patch, configuration review, evidence collection) strengthens risk‑based assurance that the organization can meet vendor‑risk and audit expectations.
Recommended Actions
- Apply Trend Micro’s latest security patches for CVE‑2021‑36741 immediately.
- Conduct a configuration review to enforce strict file‑type allow‑lists and size limits.
- Enable logging of all file‑upload attempts and integrate the logs into a SIEM for real‑time alerting.
- Map the vulnerability to the “Secure Configuration Management & Input Validation” control objective in your framework of record and capture remediation evidence in the Trust Center.
Source: CISA KEV – CVE‑2021‑36741