{"id":3665,"date":"2025-06-17T07:56:33","date_gmt":"2025-06-17T07:56:33","guid":{"rendered":"https:\/\/certera.com\/blog\/?p=3665"},"modified":"2025-06-17T07:56:34","modified_gmt":"2025-06-17T07:56:34","slug":"critical-vulnerabilities-fixed-in-trend-micros-apex-central-and-policyserver","status":"publish","type":"post","link":"https:\/\/certera.com\/blog\/critical-vulnerabilities-fixed-in-trend-micros-apex-central-and-policyserver\/","title":{"rendered":"Critical Vulnerabilities Fixed in Trend Micro’s Apex Central and PolicyServer"},"content":{"rendered":"\n

If you’re using Trend Micro Apex Central<\/strong> or Endpoint Encryption PolicyServer<\/strong>, here’s some urgent news. Hackers could take full control of your system, no login required.<\/p>\n\n\n\n

On June 10th, Trend Micro released urgent patches<\/a> for ten security flaws, including six unauthenticated remote code execution (RCE) vulnerabilities rated critical with CVSS scores of 9.8.<\/strong> And Trend Micro just patched ten of them.<\/p>\n\n\n\n

What Are These Products?<\/h2>\n\n\n\n

Trend Micro products are widely used in large enterprises, especially in industries that handle sensitive data. That\u2019s why this latest update is a big deal. <\/p>\n\n\n\n

There\u2019s a good chance you’re using one of these tools:<\/strong><\/p>\n\n\n\n

Trend Micro Apex Central:<\/strong> This is the command centre of your Trend Micro ecosystem. It controls policies, monitors threats, and manages your entire security infrastructure across multiple products.<\/p>\n\n\n\n

Trend Micro Endpoint Encryption (TMEE) PolicyServer:<\/strong> This manages full-disk and removable media encryption. It\u2019s the backbone of data protection for laptops, USB drives, and sensitive endpoint devices.<\/p>\n\n\n\n

Both tools are critical in ensuring compliance and preventing data breaches. But ironically, a series of flaws in these very systems opened the door for attackers.<\/p>\n\n\n\n

What Did Trend Micro Patch?<\/h2>\n\n\n\n

Apex Central: Two Critical Flaws Patched<\/h3>\n\n\n\n

Two bugs, tracked as CVE-2025-49219<\/strong> and CVE-2025-49220,<\/strong> were found in Apex Central. Both involve insecure deserialization, a common but dangerous coding mistake where user-supplied input is converted into executable code without proper validation.<\/p>\n\n\n\n

This allows an unauthenticated attacker, literally anyone with access, to remotely execute code in the context of the NETWORK SERVICE<\/strong> account. That\u2019s powerful enough to begin lateral movement, download malware, or disable parts of your network protection silently. <\/p>\n\n\n\n

Both flaws are rated 9.8 <\/strong>on the CVSS scale, which is about as bad as it gets.<\/p>\n\n\n\n

PolicyServer: Eight Vulnerabilities (Four Critical)<\/h3>\n\n\n\n

The Endpoint Encryption PolicyServer<\/strong> had a group of eight flaws, four of which are critical. Here\u2019s a closer look at the big ones:<\/p>\n\n\n\n

CVE-2025-49212 & CVE-2025-49213:<\/strong> These two pre-authentication RCE bugs occur in different classes but have the same underlying issue: deserialization of untrusted data. An attacker can exploit them remotely and gain SYSTEM-level access. No login required.<\/p>\n\n\n\n

CVE-2025-49216:<\/strong> This one\u2019s especially worrying. It\u2019s an authentication bypass flaw. A broken auth implementation in the DbAppDomain<\/strong> service allows attackers to skip the login process altogether and jump straight into admin-level privileges.<\/p>\n\n\n\n

CVE-2025-49217:<\/strong> Another RCE triggered by unsafe deserialization in the ValidateToken<\/strong> method. Slightly more complex to exploit, but still lethal if successfully used.<\/p>\n\n\n\n

The remaining four flaws include three<\/strong> \u201cSQL injection vulnerabilities\u201d<\/strong> that could lead to privilege escalation, and another deserialization issue that allows attackers to move from basic to SYSTEM-level access, as long as they already have a foothold on the machine.<\/p>\n\n\n\n

All of these bugs were found and responsibly disclosed via the Zero Day Initiative (ZDI), <\/strong>a program that rewards researchers for reporting bugs before they\u2019re used maliciously.<\/p>\n\n\n\n

Why This Is a Big Deal?<\/h2>\n\n\n\n

As of now, no known attacks have used these vulnerabilities and been exploited in the wild. But here\u2019s the thing: it\u2019s not about what\u2019s happened, it\u2019s about what could happen. These flaws don\u2019t require any special access. <\/p>\n\n\n\n

They\u2019re unauthenticated, remote, and affect the very systems you depend on to enforce security policies, protect encryption keys, and monitor threats across your organisation.<\/p>\n\n\n\n

\n

As Jason Soroko<\/strong>, senior fellow at Sectigo, put it: \u201cA foothold here means an attacker can disable agents, push malware, and recover recovery keys.\u201d<\/p>\n<\/blockquote>\n\n\n\n

And since PolicyServer often integrates with Active Directory<\/strong>, a successful breach could give attackers the keys to your entire domain, including domain controllers.<\/p>\n\n\n\n

Trend Micro\u2019s Fixes and What You Need to Do Now<\/h2>\n\n\n\n

Trend Micro has issued patches and updates, but you need to deploy them manually if you’re using on-premise deployments. Here\u2019s how to fix it:<\/strong><\/p>\n\n\n\n

For Apex Central:<\/h3>\n\n\n\n