CVE-2020-8468: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

CVE-2020-8468 is a content validation escape vulnerability affecting Trend Micro Apex One (2019), OfficeScan XG, and Worry-Free Business Security (9.0, 9.5, 10.0) agents. The vulnerability was disclosed in March 2020 and requires user authentication for exploitation (CVE Details, CISA).

The vulnerability exists in the agent client components of affected Trend Micro products, allowing an authenticated attacker to manipulate certain agent client components through a content validation escape (Tenable Blog, The Record).

If successfully exploited, this vulnerability allows authenticated attackers to manipulate certain agent client components of the affected Trend Micro security products, potentially compromising the security of the system (CVE Details).

Trend Micro confirmed that there was "at least one active attempt" to exploit this vulnerability in the wild. The vulnerability requires authentication for exploitation, which somewhat limits its potential attack surface (Tenable Blog).

Trend Micro released patches for the affected products. For Apex One 2019, users should update to CP 2117, for OfficeScan XG SP1 to XG SP1 CP 5474, and for OfficeScan XG (non-SP) to XG CP 1988 (Tenable Blog).