What is the CVSS score of CVE-2025-49218?

CVE-2025-49218 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Trend Micro are affected by CVE-2025-49218?

Trend Micro Endpoint Encryption PolicyServer contains a post-authentication SQL injection vulnerability (CVE-2025-49218) that enables low-privileged users to escalate privileges and compromise…. A patch is available.

How to fix or mitigate CVE-2025-49218?

Within 24 hours: Identify all Trend Micro Endpoint Encryption PolicyServer instances in your environment and document current versions. Within 7 days: Apply the vendor-released patch to all PolicyServer instances; contact Trend Micro support for exact patch version numbers matching your current deployments. Within 30 days: Conduct access review of PolicyServer administrative accounts to remove unnecessary low-privilege user access; implement network segmentation restricting PolicyServer access to authorized administrators only.

Trend Micro CVE-2025-49218

EUVD-2025-18560 HIGH

SQL Injection (CWE-89)

2025-06-17 security@trendmicro.com

SQLi Trend Micro Privilege Escalation Trend Micro Endpoint Encryption

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.0.0.4013

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18560

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 21:15 nvd

HIGH 7.7

DescriptionCVE.org

A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.

AnalysisAI

Post-authentication SQL injection vulnerability in Trend Micro Endpoint Encryption PolicyServer that allows low-privileged authenticated users to escalate privileges through SQL injection attacks. The vulnerability has a CVSS score of 7.7 (high severity) with significant impact on confidentiality, integrity, and availability. While this is a post-auth vulnerability requiring initial low-privileged code execution, successful exploitation enables privilege escalation, making it a critical concern for organizations running affected PolicyServer instances.

Technical ContextAI

This vulnerability exploits improper input validation in SQL query construction within Trend Micro Endpoint Encryption PolicyServer (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The PolicyServer component, which manages encryption policies across endpoints, fails to properly sanitize user-supplied input before incorporating it into SQL queries. Unlike pre-authentication SQL injection, this variant requires the attacker to already have low-privileged access to the system, reducing the attack surface but increasing post-compromise risk. The vulnerability is similar to but distinct from CVE-2025-49215, suggesting a class of related SQL injection issues in the same product line that may indicate systemic input validation weaknesses in the PolicyServer codebase.

RemediationAI

Apply vendor-supplied security patches from Trend Micro immediately upon availability. Check Trend Micro's official security advisory portal for CVE-2025-49218 patch details and affected version numbers. 2. Implement access controls limiting local system access to PolicyServer to authorized administrators only. 3. Restrict PolicyServer database access to authenticated, authorized users through role-based access control (RBAC). 4. Monitor PolicyServer logs for suspicious SQL patterns or unusual database query activity that may indicate exploitation attempts. 5. Implement input validation and parameterized/prepared SQL statements in any custom scripts or integrations with PolicyServer. 6. Consider network segmentation to restrict PolicyServer access to trusted administrative networks only. 7. Maintain current backups of PolicyServer database and configurations to enable rapid recovery if compromise occurs.