Trend Micro · Apex One, OfficeScan and Worry-Free Business Security Agents
CVE-2020-8468
Trend Micro Multiple Products Content Validation Escape Vulnerability
What it is
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.
CISA: Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from Trend Micro
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 21, 2026 | (On-Premise) Directory Traversal | Apex One | Medium 6.7 | 13% |
| Aug 18, 2025 | OS Command Injection | Apex One | Critical 9.4 | 25% |
| Sep 21, 2023 | Remote Code Execution | Apex One and Worry-Free Business Security | High 7.2 | 4.2% |
| Sep 15, 2022 | Improper Validation | Apex One and Apex One as a Service | High 7.2 | 3.4% |
| Mar 31, 2022 | Arbitrary File Upload | Apex Central | Critical 9.8 | 19% |
| Nov 3, 2021 | Remote Code Execution | Apex One and OfficeScan | High 8.8 | 11% |
| Nov 3, 2021 | Authentication Bypass | Apex One and OfficeScan | Critical 9.8 | 12% |
| Nov 3, 2021 | Directory Traversal | OfficeScan | High 8.8 | 25% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.