What is the CVSS score of CVE-2025-49214?

CVE-2025-49214 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.7%.

Which versions of Trend Micro are affected by CVE-2025-49214?

Trend Micro Endpoint Encryption PolicyServer contains a post-authentication remote code execution vulnerability (CVSS 8.8) that could allow an attacker with low-privileged system access to gain full…. A patch is available.

How to fix or mitigate CVE-2025-49214?

Within 24 hours: Identify all Trend Micro Endpoint Encryption PolicyServer deployments and document current versions. Within 7 days: Apply the vendor-released patch to all affected PolicyServer instances; test in non-production environment first. Within 30 days: Complete patch deployment across all production systems and verify successful updates through Trend Micro management console.

Trend Micro CVE-2025-49214

EUVD-2025-28284 HIGH

Use of Obsolete Function (CWE-477)

2025-06-17 security@trendmicro.com

Deserialization RCE Trend Micro Privilege Escalation Trend Micro Endpoint Encryption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.0.0.4013

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28284

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 21:15 nvd

HIGH 8.8

DescriptionCVE.org

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.

AnalysisAI

Post-authentication insecure deserialization vulnerability in Trend Micro Endpoint Encryption PolicyServer that allows remote code execution with high impact on confidentiality, integrity, and availability. While the CVSS score of 8.8 is significant, exploitation requires prior low-privileged code execution on the target system, substantially reducing real-world attack surface compared to unauthenticated network exploits. The vulnerability affects Trend Micro Endpoint Encryption installations and should be prioritized based on organizational exposure to this specific product line and internal threat modeling of low-privileged account compromise scenarios.

Technical ContextAI

This vulnerability exists in the deserialization handling mechanisms of Trend Micro Endpoint Encryption PolicyServer, which processes untrusted serialized objects without proper validation. CWE-477 (Use of Obsolete Function) indicates the root cause involves deprecated or inherently unsafe deserialization functions. The PolicyServer component is responsible for managing encryption policies across endpoints and likely uses Java or .NET serialization frameworks (common in enterprise management tools). The insecure deserialization pattern allows an authenticated attacker to inject malicious serialized payloads that execute arbitrary code during object reconstruction. Trend Micro Endpoint Encryption is designed for data-at-rest and data-in-transit protection; the PolicyServer is the centralized management interface that would typically run on dedicated infrastructure with network isolation.

RemediationAI

Immediately apply security patches released by Trend Micro for CVE-2025-49214 to affected PolicyServer instances. 2) Implement network segmentation to restrict PolicyServer access to only authorized management subnets and administrative endpoints. 3) Enforce strong authentication (multi-factor authentication) for PolicyServer administrative access to prevent low-privileged account compromise that could serve as attack prerequisite. 4) Monitor PolicyServer logs and process execution for suspicious deserialization activity or unexpected code execution patterns. 5) Isolate PolicyServer on separate VLAN with intrusion detection/prevention systems configured to detect anomalous serialized object payloads. 6) Review and revoke unnecessary low-privileged service accounts with PolicyServer access. Consult Trend Micro's official security advisory page and patch management portal for specific version numbers and automated patching procedures.