Critical Vulnerabilities Fixed in Trend Micro’s Apex Central and PolicyServer

If you’re using Trend Micro Apex Central or Endpoint Encryption PolicyServer, here’s some urgent news. Hackers could take full control of your system, no login required.

On June 10th, Trend Micro released urgent patches for ten security flaws, including six unauthenticated remote code execution (RCE) vulnerabilities rated critical with CVSS scores of 9.8. And Trend Micro just patched ten of them.

What Are These Products?

Trend Micro products are widely used in large enterprises, especially in industries that handle sensitive data. That’s why this latest update is a big deal.

There’s a good chance you’re using one of these tools:

Trend Micro Apex Central: This is the command centre of your Trend Micro ecosystem. It controls policies, monitors threats, and manages your entire security infrastructure across multiple products.

Trend Micro Endpoint Encryption (TMEE) PolicyServer: This manages full-disk and removable media encryption. It’s the backbone of data protection for laptops, USB drives, and sensitive endpoint devices.

Both tools are critical in ensuring compliance and preventing data breaches. But ironically, a series of flaws in these very systems opened the door for attackers.

What Did Trend Micro Patch?

Apex Central: Two Critical Flaws Patched

Two bugs, tracked as CVE-2025-49219 and CVE-2025-49220, were found in Apex Central. Both involve insecure deserialization, a common but dangerous coding mistake where user-supplied input is converted into executable code without proper validation.

This allows an unauthenticated attacker, literally anyone with access, to remotely execute code in the context of the NETWORK SERVICE account. That’s powerful enough to begin lateral movement, download malware, or disable parts of your network protection silently.

Both flaws are rated 9.8 on the CVSS scale, which is about as bad as it gets.

PolicyServer: Eight Vulnerabilities (Four Critical)

The Endpoint Encryption PolicyServer had a group of eight flaws, four of which are critical. Here’s a closer look at the big ones:

CVE-2025-49212 & CVE-2025-49213: These two pre-authentication RCE bugs occur in different classes but have the same underlying issue: deserialization of untrusted data. An attacker can exploit them remotely and gain SYSTEM-level access. No login required.

CVE-2025-49216: This one’s especially worrying. It’s an authentication bypass flaw. A broken auth implementation in the DbAppDomain service allows attackers to skip the login process altogether and jump straight into admin-level privileges.

CVE-2025-49217: Another RCE triggered by unsafe deserialization in the ValidateToken method. Slightly more complex to exploit, but still lethal if successfully used.

The remaining four flaws include three “SQL injection vulnerabilities” that could lead to privilege escalation, and another deserialization issue that allows attackers to move from basic to SYSTEM-level access, as long as they already have a foothold on the machine.

All of these bugs were found and responsibly disclosed via the Zero Day Initiative (ZDI), a program that rewards researchers for reporting bugs before they’re used maliciously.

Why This Is a Big Deal?

As of now, no known attacks have used these vulnerabilities and been exploited in the wild. But here’s the thing: it’s not about what’s happened, it’s about what could happen. These flaws don’t require any special access.

They’re unauthenticated, remote, and affect the very systems you depend on to enforce security policies, protect encryption keys, and monitor threats across your organisation.

As Jason Soroko, senior fellow at Sectigo, put it: “A foothold here means an attacker can disable agents, push malware, and recover recovery keys.”

And since PolicyServer often integrates with Active Directory, a successful breach could give attackers the keys to your entire domain, including domain controllers.

Trend Micro’s Fixes and What You Need to Do Now

Trend Micro has issued patches and updates, but you need to deploy them manually if you’re using on-premise deployments. Here’s how to fix it:

For Apex Central:

• If you’re using the on-premise version, install Patch B7007 immediately.
• If you’re on Apex Central as a Service, the fixes are already applied on the backend.

For PolicyServer:

• Upgrade to version 6.0.0.4013 (Patch 1 Update 6), which contains all fixes.
• No workarounds or mitigations exist; patching is the only option.

Not Just a Patch, You Also Need to Do This

Patching is step one. But here’s what else you should consider doing:

1. Audit who and what has access to management ports. If an attacker can reach your PolicyServer or Apex Central over the network, they could exploit these bugs. Use firewalls and network segmentation to protect them.
2. Review logs for abuse patterns. Specifically, look for .NET deserialization errors, unusual config changes, or login bypass attempts.
3. Check for shared libraries across other Trend Micro tools. Soroko points out that these flaws may stem from a shared codebase, meaning other products might be at risk too.
4. Run a vulnerability scan across your fleet. Tools like Qualys, Nessus, or even Trend Micro’s own scanners can help identify if unpatched versions are still in your environment.

Conclusion

Security vulnerabilities are like cracks in a dam. Everything might look fine until one day, it breaks.

This patch from Trend Micro isn’t just another routine update. It’s a direct response to flaws that could completely compromise your network, data, and user trust. So don’t wait until you’re trending on Twitter for the wrong reasons.

Your encryption system is only as strong as its weakest link, and right now, that link needs urgent attention.

And if manually checking every vulnerability feels like a full-time job, that’s because it is. That’s why we recommend using tools like SiteLock, an automated security solution that helps detect and patch vulnerabilities in real-time before attackers can exploit them. Whether it’s RCE, SQL injection, or broken authentication, SiteLock keeps an eye on it all.

If you are looking for a “technical advisor” for your organisation, contact us.