Trend Micro Patches Critical Vulnerabilities in Apex Central and TMEE PolicyServer
TL;DR
Trend Micro has released patches addressing multiple critical vulnerabilities in its Apex Central and Endpoint Encryption (TMEE) PolicyServer products. These vulnerabilities include remote code execution and authentication bypass issues. Users are urged to apply the security updates immediately to mitigate risks.
Main Content
Trend Micro has addressed several critical vulnerabilities impacting its Endpoint Encryption (TMEE) PolicyServer and Apex Central solutions. These patches resolve significant security issues, including remote code execution and authentication bypass vulnerabilities.
Trend Micro Endpoint Encryption PolicyServer
The Trend Micro Endpoint Encryption PolicyServer is a centralized management server used in Trend Micro’s Endpoint Encryption solution. It plays a crucial role in managing and enforcing encryption policies across all endpoints in an organization.
Trend Micro has released a patch for the Trend Micro Endpoint Encryption PolicyServer that resolves several critical vulnerabilities. These vulnerabilities affect Windows versions before 6.0.0.4013. Below is a description of the identified issues:
-
CVE-2025-49211 (CVSS score 7.7): SQL Injection Privilege Escalation Vulnerability: This flaw could allow an attacker to escalate privileges on affected installations. Note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
-
CVE-2025-49212 (CVSS score 9.8): Deserialization of Untrusted Data RCE Vulnerability: This vulnerability could lead to pre-authentication remote code execution on affected installations. It is similar to CVE-2025-49220 but affects a different method.
-
CVE-2025-49213 (CVSS score 9.8): Deserialization of Untrusted Data RCE Vulnerability: This issue is similar to CVE-2025-49212 but affects a different method.
-
CVE-2025-49214 (CVSS score 8.8): Deserialization of Untrusted Data RCE Vulnerability: This flaw could lead to post-authentication remote code execution. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
-
CVE-2025-49215 (CVSS score 8.8): SQL Injection Privilege Escalation Vulnerability: This post-auth SQL injection vulnerability could allow an attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
-
CVE-2025-49216 (CVSS score 9.8): Authentication Bypass Vulnerability: This vulnerability could allow an attacker to access key methods as an admin user and modify product configurations on affected installations.
-
CVE-2025-49217 (CVSS score 9.8): Deserialization of Untrusted Data RCE Vulnerability: This issue is similar to CVE-2025-49213 but affects a different method.
-
CVE-2025-49218 (CVSS score 9.8): SQL Injection Privilege Escalation Vulnerability: This post-auth SQL injection vulnerability could allow an attacker to escalate privileges on affected installations. It is similar to, but not identical to, CVE-2025-49215.
These vulnerabilities have been addressed in version 6.0.0.4013 (Patch 1 Update 6). Trend Micro emphasizes that there are no mitigations or workarounds for these issues, and immediate application of the security updates is recommended.
Trend Micro Apex Central
Apex Central is a web-based console that provides centralized management for Trend Micro products and services. It offers a single monitoring point for antivirus and content security products and services throughout the network.
Trend Micro has fixed the following vulnerabilities in Apex Central:
-
CVE-2025-49219 (CVSS score 9.8): Deserialization of Untrusted Data RCE Vulnerability: This vulnerability could lead to pre-authentication remote code execution on affected installations. It is similar to CVE-2025-49220 but affects a different method.
-
CVE-2025-49220 (CVSS score 9.8): Deserialization of Untrusted Data RCE Vulnerability: This issue could lead to pre-authentication remote code execution on affected installations. It is similar to CVE-2025-49219 but affects a different method.
Trend Micro has stated that these vulnerabilities have not been observed being actively exploited in the wild.
Conclusion
Trend Micro’s proactive approach to addressing these critical vulnerabilities underscores the importance of regular security updates. Users are advised to apply the patches immediately to protect their systems from potential exploits. Staying vigilant and up-to-date with security measures is crucial in safeguarding against emerging threats.
Additional Resources
For further insights, check: