CVE-2020-24557: Trend Micro Apex One and Worry-Free Business Security folder manipulation privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe vulnerability is in CISA KEV with known exploitation and allows local privilege escalation plus disabling of endpoint protection, though it requires prior low-privileged code execution.

What it is

Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Windows allow an attacker to manipulate a product folder to temporarily disable the security product and abuse a Windows function to escalate privileges. The flaw is an access-control weakness in the product's file handling, and it matters because it lets a local low-privileged user neutralize endpoint protection and gain higher privileges.

Impact

An attacker with existing low-privileged code execution can disable the security product temporarily and escalate to higher privileges on the host.

Attack surface

The attack is local (CVSS vector AV:L) and requires low privileges (PR:L) with no user interaction (UI:N). The attacker must already be able to execute low-privileged code on the target system before exploiting the folder manipulation.

Exploitation

CVE-2020-24557 is listed in CISA KEV with a 2022-05-03 remediation due date, indicating known exploitation, while EPSS is low at roughly 2.6 percent for 30-day activity. No ransomware campaign use is documented in the record.

What to do

• Apply the vendor updates referenced in Trend Micro advisories 000263632 and 000267260.
• Upgrade Windows hosts to version 1909 (OS Build 18363.719) or later, which mitigates hard link abuse.
• Restrict local interactive and service account privileges to limit who can execute low-privileged code on endpoints.
• Monitor and harden permissions on Trend Micro product folders to prevent unauthorized manipulation.

Detection

• Alert on unexpected changes to Trend Micro Apex One or Worry-Free Business Security product folders and files.
• Monitor for security service or agent processes stopping, being disabled, or failing unexpectedly on endpoints.
• Correlate local privilege escalation events with prior low-privileged process execution on the same host.
• Review Windows hard link creation activity on affected builds prior to 1909 (Build 18363.719).

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.