VulnTideExploited vulnerabilities, by vendor. Data as of .
Known exploitedIn CISA's KEV catalog since Ransomware use: unknown
Trend Micro Apex One and OfficeScan

CVE-2020-8467: Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 595 days after the CVE record was published.

How likely is exploitation in the next 30 days?
10.9%

EPSS score, percentile 95.9 of all scored records

How severe?
8.8 High

CVSS v3.1 base score, from CISA's enrichment of the record

What should I do?

CISA deadline . Apply updates per vendor instructions.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

  • OfficeScan XG (12.0), Apex One 2019 (14.0)

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

What to do

Required action, set by CISA

Apply updates per vendor instructions.

CISA due date for this action: .

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

Trend Micro Trend Micro OfficeScan, Trend Micro Apex One
StatusVersions
AffectedOfficeScan XG (12.0), Apex One 2019 (14.0)

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

About this vulnerability

Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.

Summary: CISA's KEV catalog, as of .

  • CISA added CVE-2020-8467 to its Known Exploited Vulnerabilities (KEV) catalog on 3 Nov 2021.
  • CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
  • The due date CISA sets for the required action is 3 May 2022.
  • The CVE record was published on 18 Mar 2020, 595 days before it was added to KEV.
  • The CVE record carries a CVSS v3.1 base score of 8.8 (High), taken from CISA's enrichment of the record.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 10.9% (percentile 95.9), as of 28 Oct 2026.
  • CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.

Description

A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

Timeline

DateEvent
CVE record published
Added to CISA KEV
CISA due date for the required action
CVE record last updated

References

More exploited Trend Micro vulnerabilities

  • CVE-2026-34926: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability (added )
  • CVE-2025-54948: Trend Micro Apex One OS Command Injection Vulnerability (added )
  • CVE-2023-41179: Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability (added )
  • CVE-2022-40139: Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability (added )
  • CVE-2022-26871: Trend Micro Apex Central Arbitrary File Upload Vulnerability (added )
  • CVE-2019-18187: Trend Micro OfficeScan Directory Traversal Vulnerability (added )