Pierluigi Paganini
June 13, 2025
Trend Micro address remote code execution and authentication bypass vulnerabilities impacting its Endpoint Encryption (TMEE) PolicyServer and Apex Central solutions.
Trend Micro Endpoint Encryption PolicyServer is a centralized management server used in Trend Micro’s Endpoint Encryption solution. It acts as the core component for managing and enforcing encryption policies across all endpoints in an organization.
“Trend Micro has released a patch for the Trend Micro Endpoint Encryption PolicyServer that resolves several critical vulnerabilities.” reads the advisory.
The flaws impacts Windows Versions before 6.0.0.4013. Below is the description of the vulnerabilities:
CVE-2025-49211 (CVSS score 7.7): SQL Injection Privilege Escalation Vulnerability: A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
CVE-2025-49212 (CVSS score 9.8): Deserialization of Untrusted Data RCE Vulnerability: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.
CVE-2025-49213 (CVSS score 9.8): Deserialization of Untrusted Data RCE Vulnerability: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method.
CVE-2025-49214 (CVSS score 8.8): Deserialization of Untrusted Data RCE Vulnerability: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
CVE-2025-49215 (CVSS score 8.8): SQL Injection Privilege Escalation Vulnerability: A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
The security vendor underlines that it has seen no evidence of active exploitation in the wild for any of them. However, immediate application of the security updates is recommended to address the risks.
CVE-2025-49216 (CVSS score 9.8): Authentication Bypass Vulnerability: An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations.
CVE-2025-49217 (CVSS score 9.8): Deserialization of Untrusted Data RCE Vulnerability: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method.
CVE-2025-49218 (CVSS score 9.8): SQL Injection Privilege Escalation Vulnerability: A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
The cybersecurity vendor addressed the flaw in version 6.0.0.4013 (Patch 1 Update 6), the company states that there are no mitigations or workarounds for these issues.
Apex Central™ is a web-based console that provides centralized management for Trend Micro products and services at the gateway, mail server, file server, and corporate desktop levels. Administrators can use the policy management feature to configure and deploy product settings to managed products and endpoints. The Apex Central web-based management console provides a single monitoring point for antivirus and content security products and services throughout the network.
The company fixed the following flaws in Apex Central:
CVE-2025-49219 (CVSS score 9.8): Deserialization of Untrusted Data RCE Vulnerability: An insecure deserialization operation in Trend Micro Apex Central could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.
CVE-2025-49220 (CVSS score 9.8): Deserialization of Untrusted Data RCE Vulnerability: An insecure deserialization operation in Trend Micro Apex Central could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
The company states that these vulnerabilities have NOT been observed being actively exploited in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Apex Central)
