CVE-2020-8599: Trend Micro Apex One and OfficeScan EXE allows arbitrary file write and ROOT bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated remote arbitrary file write plus ROOT bypass, confirmed exploited in CISA KEV, makes this a top remediation priority.

What it is

Trend Micro Apex One (2019) and OfficeScan XG server ship a vulnerable EXE file that lets a remote, unauthenticated attacker write arbitrary data to an arbitrary path and bypass ROOT login. Because the flaw is reachable over the network with no credentials, it exposes the management server itself rather than just an endpoint agent.

Impact

An attacker can write files anywhere on the server and bypass ROOT authentication, which in practice yields full control of the affected installation. That control can be used to disable protection, alter configuration, or stage further compromise of managed endpoints.

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N) per the CVSS vector. The description states authentication is not required, so the vulnerable EXE is exposed to unauthenticated remote requests.

Exploitation

It is listed in CISA KEV (added 2021-11-03, due 2022-05-03), confirming exploitation in the wild; EPSS 30-day probability is about 11.9% (95.9th percentile). No ransomware campaign use is recorded in the KEV entry.

What to do

• Apply the vendor patches referenced in the Trend Micro advisories (solution 000245571 and 000244253) as the first action.
• If patching cannot be done immediately, restrict network access to the Apex One/OfficeScan server management interfaces to trusted administrative networks only.
• Audit and rotate administrative and ROOT credentials for the affected servers, since ROOT login bypass is part of the flaw.
• Monitor the server for unexpected file writes and new or modified executables in system and application paths.
• Verify the server has not been modified before returning it to production, and reimage if compromise is suspected.

Detection

• Hunt for unexpected file creation or modification in server system directories and application install paths on Apex One/OfficeScan hosts.
• Alert on successful ROOT or administrative logins to the management server that do not match known admin source IPs or schedules.
• Review server logs for unauthenticated requests to the vulnerable EXE and for anomalous process execution spawned by the management service.
• Correlate file-write events with subsequent service restarts or configuration changes on the affected server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.