CVE-2020-8599
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
Published Mar 17, 2020 · updated Jun 16, 2026 · trendmicro apex one
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
Timeline
Detection, updates, and resolution for this record.
Mar 17, 2020 · Catalog
Detected
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe trendmicro/apex one2019
- cpe trendmicro/officescanxg
- vendor Trend Micro Apex One and OfficeScanversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2020-8599
Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.
cisa.gov - CVE.orgVulnerability recordCVE-2020-8599
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2020-8599
30-day exploitation probability 11.9%
first.org - NIST NVDVulnerability recordCVE-2020-8599
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
nvd.nist.gov