What is the CVSS score of CVE-2025-49220?

CVE-2025-49220 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 7.0%.

Which versions of Trend Micro are affected by CVE-2025-49220?

Trend Micro Apex Central versions prior to 8.0.7007 contain a critical pre-authentication remote code execution vulnerability (CVSS 9.8) that allows unauthenticated attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2025-49220?

Within 24 hours: Identify all Apex Central deployments and document current versions; isolate any instances running versions below 8.0.7007 from external network access if patching cannot be completed immediately. Within 7 days: Apply vendor patch to upgrade all Apex Central installations to version 8.0.7007 or later; verify patch application across all instances. Within 30 days: Conduct forensic review of access logs and network traffic for the past 90 days to detect any exploitation attempts or lateral movement from affected systems.

Trend Micro CVE-2025-49220

EUVD-2025-18514 CRITICAL

Use of Obsolete Function (CWE-477)

2025-06-17 security@trendmicro.com

RCE Deserialization Trend Micro Apex Central

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:54 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0.7007

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18514

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 18:15 nvd

CRITICAL 9.8

DescriptionCVE.org

An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.

AnalysisAI

Critical pre-authentication remote code execution vulnerability in Trend Micro Apex Central versions below 8.0.7007, caused by insecure deserialization in a specific method. The vulnerability allows unauthenticated remote attackers to execute arbitrary code with complete system compromise (confidentiality, integrity, and availability impact). With a CVSS score of 9.8 and network-based attack vector requiring no user interaction, this represents an immediately exploitable critical threat to exposed Apex Central installations.

Technical ContextAI

The vulnerability stems from CWE-477 (Insecure Deserialization) in Trend Micro Apex Central's request handling mechanism. Insecure deserialization occurs when untrusted data is deserialized without proper validation, allowing attackers to instantiate arbitrary objects and execute malicious code during the deserialization process. This particular vulnerability affects a different method than the related CVE-2025-49219, suggesting multiple unsafe deserialization points exist within Apex Central's codebase. The vulnerability is pre-authentication, meaning the affected deserialization occurs before any user credential validation, making it exploitable from an unauthenticated network position. Affected versions are Trend Micro Apex Central prior to version 8.0.7007, likely spanning multiple minor versions of the 8.x branch and potentially earlier major versions.

RemediationAI

Immediate patching is the primary remediation: (1) Upgrade Trend Micro Apex Central to version 8.0.7007 or later; (2) Obtain patched binaries from Trend Micro's official security advisory and patch portal; (3) Apply patches according to Trend Micro's change management guidelines, noting any compatibility requirements with managed endpoints. Interim mitigations for organizations unable to patch immediately: (1) Implement network-level access controls restricting Apex Central communication to authorized management networks only; (2) Deploy WAF/IPS rules to detect and block deserialization payloads if signatures become available; (3) Monitor for suspicious deserialization patterns in application logs; (4) Isolate affected Apex Central instances from internet-facing networks; (5) Implement additional authentication layers or reverse proxies with credential requirements. Reference Trend Micro Security Bulletin or official advisory for detailed patch availability and testing requirements.