What is the CVSS score of EUVD-2025-28286?

EUVD-2025-28286 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Trend Micro are affected by EUVD-2025-28286?

Trend Micro Endpoint Encryption PolicyServer contains a critical authentication bypass vulnerability (CVE-2025-49216, CVSS 9.8) that allows unauthenticated attackers to gain administrative access and…. A patch is available.

How to fix or mitigate EUVD-2025-28286?

Within 24 hours: Identify all Trend Micro Endpoint Encryption PolicyServer instances in production and their current versions; notify Trend Micro support for patch availability and timeline. Within 7 days: Apply vendor-released patch to all PolicyServer instances after testing in non-production environment; verify administrative access controls are functioning post-patch. Within 30 days: Conduct security audit of PolicyServer administrative logs for any unauthorized configuration changes since deployment; validate encryption policy integrity across all protected endpoints.

Trend Micro EUVD-2025-28286

| CVE-2025-49216 CRITICAL

Use of Obsolete Function (CWE-477)

2025-06-17 security@trendmicro.com

Authentication Bypass Trend Micro Privilege Escalation Trend Micro Endpoint Encryption

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:54 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.0.0.4013

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28286

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 21:15 nvd

CRITICAL 9.8

DescriptionCVE.org

An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations.

AnalysisAI

Critical authentication bypass vulnerability in Trend Micro Endpoint Encryption PolicyServer that allows unauthenticated remote attackers to gain administrative access and modify product configurations without valid credentials. The vulnerability has a CVSS 9.8 score indicating severe impact (confidentiality, integrity, and availability compromised), and represents a complete authentication control failure requiring immediate patching.

Technical ContextAI

The vulnerability exploits an improper authentication mechanism (CWE-477: Improperly Implemented Security Check for Standard) in the Trend Micro Endpoint Encryption PolicyServer's administrative API or web service layer. CWE-477 indicates the product implements security checks incorrectly or incompletely, allowing attackers to bypass intended access controls. The PolicyServer component is responsible for centralized policy management across encrypted endpoints; improper authentication in this service exposes administrative functionality to unauthenticated users. The network-based attack vector (AV:N) and low attack complexity (AC:L) suggest the vulnerability is exploitable without authentication (PR:N) or user interaction (UI:N) over standard network protocols, likely HTTP/HTTPS interfaces used for remote policy administration.

RemediationAI

Apply the security patch released by Trend Micro for Endpoint Encryption PolicyServer immediately upon availability (consult Trend Micro security advisory for specific patch version numbers). 2) If patches are unavailable, implement network-level access controls restricting PolicyServer administrative interfaces to trusted administrative networks only; use firewall rules to limit access to the PolicyServer port to authorized IP ranges. 3) Disable remote administrative access if not required; configure PolicyServer for local-only administration temporarily. 4) Monitor PolicyServer logs for suspicious administrative access patterns or configuration changes that may indicate exploitation. 5) Review and audit all recent configuration changes made through PolicyServer to identify potential attacker modifications. Contact Trend Micro support (support.trendmicro.com) for patch availability and deployment guidance specific to your PolicyServer version.