{"id":"CVE-2020-8467","kind":"vulnerability","aliases":["CVE-2020-8467"],"related":[],"title":"Trend Micro Apex One and OfficeScan: Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability","description":"A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.","summary":"Trend Micro Apex One (2019) and OfficeScan XG have a migration tool component that lets a remote attacker run arbitrary code on the server. The attacker must first authenticate, and CISA lists this CVE as actively exploited.","severity":"high","cvss":8.8,"epss":0.109,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Trend Micro Apex One and OfficeScan","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apex-one","exploited","officescan","trend-micro","vendor","windows"],"not_affected_if":["managed-hosting","not-apex-one-2019-or-officescan-xg"],"how_to_check":null,"fix":null,"status":"open","published_at":"2020-03-18T01:15:11+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:39+00:00","updated_at":"2026-10-23T20:29:39+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:29:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"Trend Micro Apex One (2019) and OfficeScan XG have a migration tool component that lets a remote attacker run arbitrary code on the server. The attacker must first authenticate, and CISA lists this CVE as actively exploited.","category":"vendor","who_cares":["trend-micro","apex-one","officescan","windows"],"confidence":0.7,"analyst_note":"Find the vendor advisory and patch build for Apex One 2019 and OfficeScan XG, and the migration tool's affected version range; sources at https://nvd.nist.gov/vuln/detail/CVE-2020-8467 do not give fixed versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","not-apex-one-2019-or-officescan-xg"],"severity_if_unknown":"high"},"cost_usd":0.000363,"input_tokens":2131,"output_tokens":299,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2020':18A,21A '-8467':19A,22A '2019':43B,85C 'activ':74B 'affect':102C 'allow':94C 'and':27A 'apex':3A,9A,25A,30B,41B,83C 'apex-on':29B 'arbitrari':58B,99C 'attack':56B,64B,96C,107C 'attempt':106C 'authent':67B,110C 'cisa':69B 'code':14A,59B,100C 'compon':51B,79C 'contain':89C 'could':93C 'cve':17A,20A,72B 'execut':15A,98C 'exploit':32B,75B 'first':66B 'instal':103C 'let':53B 'list':70B 'micro':2A,8A,24A,36B,40B,82C 'migrat':49B,77C 'must':65B 'officescan':6A,12A,28A,33B,45B,87C 'one':4A,10A,26A,31B,42B,84C 'rce':104C 'remot':13A,55B,95C 'requir':108C 'run':57B 'server':62B 'tool':50B,78C 'trend':1A,7A,23A,35B,39B,81C 'trend-micro':34B 'user':109C 'vendor':37B 'vulner':16A,91C 'window':38B 'xg':46B,88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-03-18T01:15:11+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-8467","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-8467","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T12:39:25+00:00","note":null},{"source":"epss","external_id":"CVE-2020-8467","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8467","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-8467","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8467","severity":null,"published_at":"2020-03-18T01:15:11+00:00","modified_at":"2026-06-17T03:26:25+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}