Trend Micro EUVD-2025-18650

This vulnerability presents extreme real-world risk. The CVSS 3.1 score of 9.8 reflects the worst-case scenario: Network-accessible (AV:N), Low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), with unlimited scope (S:U) and complete impact (C:H/I:H/A:H). The pre-authentication nature and network accessibility mean any internet-connected instance is immediately exploitable. The CVSS vector indicates this is one of the most severe vulnerability classes possible. Given the pattern of related CVEs in the same product and the straightforward nature of deserialization exploits (well-understood attack methodology), exploitation probability is very high. If this CVE is included in CISA KEV catalog, it indicates active exploitation in the wild. The attack requires no special conditions or user interaction, making this a critical priority for any organization running Trend Micro Endpoint Encryption PolicyServer, particularly internet-exposed instances.

An attacker identifies a Trend Micro Endpoint Encryption PolicyServer instance exposed on the internet (e.g., via port scanning or asset discovery). The attacker crafts a malicious serialized Java object (or equivalent depending on PolicyServer's runtime) containing a gadget chain that executes system commands. This payload is sent to an unauthenticated API endpoint or service port on PolicyServer (e.g., via HTTP POST or direct socket connection). PolicyServer deserializes the malicious object without validation, instantiating gadget chain classes that chain together to execute arbitrary commands (e.g., reverse shell, credential theft, lateral movement). The attacker gains remote code execution with the privileges of the PolicyServer process (typically SYSTEM/root on Windows/Linux). From this position, the attacker can: exfiltrate encrypted keys managed by PolicyServer, modify encryption policies to weaken security, establish persistent backdoors, or pivot to client endpoints. No user interaction or authentication required. Exploitation can occur within seconds of network connection. If a public POC exists (common for deserialization vulnerabilities), attack complexity is trivial for any attacker with basic networking knowledge.