CVE-2020-8467

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro OfficeScan, Trend Micro Apex One	OfficeScan XG (12.0), Apex One 2019 (14.0)

References

https://success.trendmicro.com/jp/solution/000244253Patch, Vendor Advisory
https://success.trendmicro.com/solution/000245571Patch, Vendor Advisory
https://success.trendmicro.com/jp/solution/000244253Patch, Vendor Advisory
https://success.trendmicro.com/solution/000245571Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8467US Government Resource

Timeline

Published: Mar 18, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-84688.8Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation esc CVE-2020-84697.8Trend Micro Password Manager for Windows version 5.0 is affected by a DLL hijacking vulnerability would could potentially allow an attacker CVE-2020-84707.5Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file t CVE-2020-84717.8For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 an CVE-2020-84727.8Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Co CVE-2020-84737.8Insufficient folder permissions used by system functions in ABB System 800xA Base (version 6.1 and earlier) allow low privileged users to re CVE-2020-84747.8Weak Registry permissions in ABB System 800xA Base allow low privileged users to read and modify registry settings related to control system CVE-2020-84757.5For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 an CVE-2020-84767.5For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 an CVE-2020-84778.8The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An a CVE-2020-84783.3Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC CVE-2020-84799.8For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 an