What is the CVSS score of CVE-2025-49212?

CVE-2025-49212 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 4.4%.

Which versions of Trend Micro are affected by CVE-2025-49212?

Trend Micro Endpoint Encryption PolicyServer contains a critical pre-authentication remote code execution vulnerability (CVE-2025-49212, CVSS 9.8) that allows unauthenticated network attackers to…. A patch is available.

How to fix or mitigate CVE-2025-49212?

Within 24 hours: Identify all Trend Micro Endpoint Encryption PolicyServer instances in your environment and isolate them from untrusted networks if immediate patching is not feasible. Within 7 days: Apply the vendor-released patch to all PolicyServer installations-contact Trend Micro support or consult their security advisory for the specific patched version number for your current deployment. Within 30 days: Verify patch deployment across all instances and implement network segmentation to restrict PolicyServer access to authorized endpoints only.

Trend Micro CVE-2025-49212

EUVD-2025-18640 CRITICAL

Use of Obsolete Function (CWE-477)

2025-06-17 security@trendmicro.com

Deserialization RCE Trend Micro Authentication Bypass Trend Micro Endpoint Encryption

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:54 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.0.0.4013

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18640

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 21:15 nvd

CRITICAL 9.8

DescriptionCVE.org

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.

AnalysisAI

Pre-authentication remote code execution vulnerability in Trend Micro Endpoint Encryption PolicyServer caused by insecure deserialization in an unnamed method. An unauthenticated attacker on the network can exploit this over the network without user interaction to achieve complete system compromise (confidentiality, integrity, and availability impact). This vulnerability is actively monitored and represents a critical threat requiring immediate patching.

Technical ContextAI

The vulnerability exists in the deserialization processing logic of Trend Micro Endpoint Encryption PolicyServer's network-accessible service component. CWE-477 (Use of Obsolete Function) combined with insecure deserialization practices represents a dangerous pattern where untrusted serialized objects are reconstructed without proper validation. The PolicyServer component handles encryption policy distribution and management across enterprise endpoints; its network-facing position makes it an attractive target. The similarity to CVE-2025-49220 (affecting a different method in the same product) suggests a systemic issue with deserialization handling across multiple code paths within the PolicyServer service, potentially indicating the use of legacy or unsafe serialization frameworks without proper input validation.

RemediationAI

Immediate actions: (1) Consult the official Trend Micro security advisory for CVE-2025-49212 to identify your installed version's vulnerability status; (2) Apply vendor-released security patches immediately upon availability—do not delay; (3) If patches are not yet available, implement network segmentation to restrict access to PolicyServer to trusted administrative networks only, removing direct internet accessibility; (4) Monitor PolicyServer logs for suspicious serialization-related errors or unexpected connection attempts; (5) Consider temporary disablement of PolicyServer if operationally feasible until patches are deployed and tested; (6) Review and strengthen authentication mechanisms for any management interfaces as a defense-in-depth measure. References to patches should be obtained directly from Trend Micro's official security portal.