CVE-2020-8605: Trend Micro InterScan Web Security Virtual Appliance OS command injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityAuthenticated remote code execution on an internet-facing security appliance with public exploit code and very high EPSS, though it is not in KEV and requires credentials.

What it is

Trend Micro InterScan Web Security Virtual Appliance 6.5 contains an OS command injection flaw (CWE-78) that lets a remote attacker run arbitrary code on the appliance. The attacker must first authenticate, so the flaw is most dangerous as a post-authentication escalation to full command execution on a security gateway.

Impact

An authenticated attacker gains arbitrary code execution on the appliance, with high impact to confidentiality, integrity and availability per the CVSS vector. Because the device sits inline as a web security gateway, code execution there can expose inspected traffic and credentials.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires low-privileged credentials (PR:L). No pre-auth path is described in the record.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.8776, ~99.75th percentile) and multiple references are tagged Exploit, indicating public exploit code exists. No ransomware association is documented.

What to do

• Apply the vendor patch referenced in Trend Micro solution 000253095 for InterScan Web Security Virtual Appliance 6.5.
• Restrict management and appliance access to trusted networks and remove or disable unused accounts to limit who can reach the authenticated attack path.
• Rotate credentials and review accounts on the appliance for signs of compromise after patching.
• If patching cannot be done immediately, isolate the appliance behind strict network controls and monitor it closely.

Detection

• Monitor appliance and system logs for unexpected child processes or shell commands spawned by the web application.
• Alert on unusual outbound connections or process execution from the InterScan appliance host.
• Audit authentication logs for logins from unusual sources preceding command execution activity.
• Watch for known exploit payload patterns against the appliance's web interface in HTTP logs or IDS/IPS.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.