Trend Micro EUVD-2025-18647

This vulnerability presents CRITICAL real-world risk: (1) CVSS 9.8 with AV:N (network-accessible), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction) indicates maximum exploitability; (2) Pre-authentication nature combined with remote network access means ANY internet-connected Trend Micro PolicyServer is immediately exploitable; (3) The vulnerability allows complete system compromise (C:H, I:H, A:H); (4) The similarity to CVE-2025-49212 in different methods suggests multiple exploitation vectors exist; (5) This is a textbook critical vulnerability with no mitigating factors - high CVSS correlates directly to high real-world risk. SSVC framework assessment: Exploitation maturity is likely PROOF-OF-CONCEPT or ACTIVE given the straightforward nature of deserialization exploits; automatable = YES (network-based, no user interaction); technical impact = TOTAL (RCE with full system access). This is a priority-1 emergency patch.

An attacker performs network reconnaissance to identify a Trend Micro Endpoint Encryption PolicyServer instance (likely listening on port 443). The attacker crafts a malicious serialized object payload containing arbitrary code (possibly using Java deserialization gadget chains or language-specific equivalents depending on PolicyServer implementation). The attacker sends this payload to the PolicyServer's network interface, targeting the vulnerable deserialization method. The PolicyServer deserializes the untrusted data without validation, instantiating the malicious object and executing embedded code during the deserialization process. The attacker gains remote code execution with SYSTEM/root privileges on the PolicyServer, enabling them to: exfiltrate encryption keys and policies affecting all managed endpoints, modify encryption policies to disable protections, pivot to protected endpoints, or use the compromised PolicyServer as a beachhead for lateral movement within the organization. No authentication, no user interaction, and no special conditions are required - making this exploitable by any attacker with network access to the PolicyServer.