CVE-2021-36742: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

CVE-2021-36742 is an improper input validation vulnerability affecting Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1. The vulnerability was discovered in July 2021 and allows a local attacker to escalate privileges on affected installations (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-20 (Improper Input Validation). An important prerequisite for exploitation is that an attacker must first obtain the ability to execute low-privileged code on the target system (NVD).

If successfully exploited, this vulnerability allows an attacker with low-level privileges to escalate to higher privileges on affected installations. The high CVSS score indicates severe potential impacts on confidentiality, integrity, and availability of the affected systems (NVD).

The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog on November 3, 2021, indicating that it has been actively exploited in the wild. CISA required federal agencies to address this vulnerability by November 17, 2021 (CISA KEV).

Trend Micro has released security updates to address this vulnerability. Organizations should apply the vendor-provided updates according to the advisories published by Trend Micro (Vendor Advisory, Vendor Advisory).