CVE-2020-8467: Trend Micro Apex One and OfficeScan migration tool RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a network-reachable RCE in endpoint security management software that is listed in CISA KEV, though exploitation requires prior authentication.

What it is

A component of the migration tool in Trend Micro Apex One (2019) and OfficeScan XG allows remote attackers to execute arbitrary code on affected installations. The flaw is remotely reachable over the network with low complexity, but an attacker must first authenticate. Because these are endpoint security management products, successful exploitation gives an attacker a foothold on the management infrastructure itself.

Impact

An authenticated remote attacker can execute arbitrary code on the affected installation, gaining the privileges of the vulnerable service and potentially control over the endpoint protection management server.

Attack surface

Reached over the network (AV:N) with low attack complexity and no user interaction (UI:N), but the vector requires low privileges (PR:L), meaning the attacker needs valid authentication before attempting the attack.

Exploitation

The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating real-world exploitation; EPSS gives a 30-day probability of about 0.109 (95.6th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor updates referenced in Trend Micro advisories 000244253 and 000245571 as soon as possible.
• Restrict network access to the Apex One/OfficeScan management and migration tool interfaces to trusted administrative networks.
• Enforce least privilege and strong authentication for accounts that can reach the migration tool component.
• Monitor for and remove unnecessary or legacy migration tool components that are no longer required.
• Verify remediation against CISA KEV guidance, which requires applying updates per vendor instructions.

Detection

• Monitor server and application logs for unexpected process execution or command spawning by the Apex One/OfficeScan migration tool service.
• Alert on anomalous network connections to the management server from non-administrative hosts or unusual source addresses.
• Audit authentication logs for use of low-privileged accounts accessing migration tool functionality outside normal change windows.
• Hunt for newly created files or services on the management host that do not match known Trend Micro components.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.