Trend Micro CVE-2025-49212

This vulnerability presents CRITICAL real-world risk across multiple assessment frameworks: (1) CVSS 9.8 with AV:N (network-accessible)/AC:L (no special conditions)/PR:N/UI:N indicates a trivial attack requiring only network access with no privileges or user interaction—the highest severity combination; (2) Pre-authentication status eliminates the barrier of credential compromise; (3) The existence of a related CVE (CVE-2025-49220) in the same product suggests active vulnerability discovery in this codebase and potential POC availability or imminent public disclosure; (4) PolicyServer's role as a policy distribution point means compromise enables lateral movement and policy manipulation across entire enterprise deployments; (5) EPSS scoring would likely be elevated due to network accessibility and lack of complexity. This is NOT a high-CVSS-but-low-risk issue—all signals align to indicate urgent exploitation risk.

An unauthenticated attacker (external or internal network-positioned) sends a crafted serialized object to the PolicyServer's network service port without requiring any credentials. The deserialization handler reconstructs this malicious object without validation, triggering arbitrary code execution within the PolicyServer process context. With PolicyServer typically running with elevated privileges in enterprise environments, the attacker gains system-level code execution, enabling them to: (1) extract encryption keys and policies affecting all managed endpoints, (2) modify policies to weaken encryption or capture credentials, (3) pivot to connected endpoint systems using compromised policies, (4) establish persistent backdoor access. No POC is explicitly mentioned in the CVE description, but the high CVSS, pre-auth nature, and similarity to CVE-2025-49220 suggest that exploitation is trivial and proof-of-concept development or discovery is highly probable.