CVE-2020-8599
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
Description
CVE-2020-8599 is a critical-severity authentication bypass vulnerability in Trend Micro Apex One and OfficeScan. The affected products contain a vulnerable EXE file that allows a remote attacker to write arbitrary data to an arbitrary path on the server and bypass root login, without requiring any authentication. CISA has confirmed active exploitation of this vulnerability by including it in the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS score of 57.86% (98.1st percentile), this vulnerability has a very high probability of being exploited in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| trendmicro | apex one | 2019 |
| trendmicro | officescan | xg |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://success.trendmicro.com/jp/solution/000244253(Broken Link, Patch, Vendor Advisory)
- https://success.trendmicro.com/solution/000245571(Broken Link, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8599(US Government Resource)
Weakness Type
This CVE has no formally assigned CWE classification in the NVD database. Based on the vulnerability description, the core weakness involves an authentication bypass in a server-side executable component that permits unauthorized arbitrary file writes. This type of flaw typically relates to improper authentication or authorization mechanisms that fail to validate remote requests before allowing privileged operations on the server file system.
Impact Analysis
CVE-2020-8599 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting the maximum severity tier. The vulnerability is remotely exploitable over the network with low attack complexity, requires no privileges and no user interaction, making it trivially exploitable by unauthenticated remote attackers. Successful exploitation grants full compromise of confidentiality, integrity, and availability, allowing an attacker to read sensitive data, write arbitrary files to the server, and disrupt system availability entirely. Organizations running unpatched Trend Micro Apex One (2019) or OfficeScan XG servers face an immediate risk of complete system takeover.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-8599 by listing it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 57.86% (98.1st percentile) indicates a very high likelihood of exploitation, placing this vulnerability among the most likely to be targeted. While no specific public exploit code or proof-of-concept was identified in the tracked references, the confirmed active exploitation and critical severity demand immediate remediation action.
Remediation
- Apply vendor patches immediately as required by the CISA KEV directive: Apply updates per vendor instructions. Trend Micro has released patches through their support portal addressing this vulnerability.
- Upgrade all instances of Trend Micro Apex One (2019) and OfficeScan XG to the latest patched versions available from Trend Micro. Verify that the vulnerable EXE component has been updated.
- Restrict network access to the Apex One and OfficeScan management server interfaces using firewall rules and network segmentation, ensuring only authorized administrators can reach these services.
- Monitor server file systems for unexpected file creation or modification, and review access logs on the Trend Micro management console for unauthorized login attempts or suspicious activity.
- Conduct a thorough review of affected systems to determine if the vulnerability was exploited prior to patching, checking for unauthorized files, modified configurations, or evidence of lateral movement.
Technical Details
CVE-2020-8599 targets a vulnerable EXE file within Trend Micro Apex One (2019) and OfficeScan XG servers that fails to properly authenticate incoming requests. The flaw allows a remote attacker to write arbitrary data to any path on the affected server without any authentication, effectively bypassing root login controls entirely. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based, requires no special conditions, privileges, or user interaction, and impacts all three security pillars at the highest level. The lack of an assigned CWE suggests the weakness does not map cleanly to a single category, but the behavior is consistent with a combination of improper authentication and unrestricted file write primitives that together enable full system compromise.
Frequently Asked Questions
Is CVE-2020-8599 being actively exploited?
Yes. CVE-2020-8599 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming that active exploitation has been observed in the wild. The EPSS score of 57.86% (98.1st percentile) further underscores the high probability of exploitation. There is no known association with ransomware campaigns at this time.
What products are affected by CVE-2020-8599?
CVE-2020-8599 affects Trend Micro Apex One (2019) and Trend Micro OfficeScan XG. Both products contain a vulnerable server-side EXE component that allows unauthenticated arbitrary file writes and authentication bypass.
How do I fix CVE-2020-8599?
Apply the vendor-provided patches immediately as directed by Trend Micro's security advisories. Ensure all Apex One and OfficeScan XG server instances are updated to the latest patched releases. If immediate patching is not possible, restrict network access to the management server interfaces.
How severe is CVE-2020-8599?
CVE-2020-8599 has a CVSS 3.1 score of 9.8 (CRITICAL), which is the highest severity tier. The combination of unauthenticated remote exploitation, low attack complexity, and full impact on confidentiality, integrity, and availability makes this one of the most severe vulnerabilities in the Trend Micro product line.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.