CVE-2025-49213

The vulnerability is based on an unsafe deserialization operation (CWE-502) performed before the authentication stage in the PolicyServer component. An attacker can send a specially crafted payload that, when deserialized by the server, leads to arbitrary code execution at the system level. The vulnerability affects a different method than CVE-2025-49212, but the attack mechanism is analogous. The network vector without authentication requirements and user interaction makes exploitation particularly simple.

An unauthenticated attacker can gain full control over the system running PolicyServer, including confidentiality, integrity, and availability of data (CVSS ratings: C:H/I:H/A:H). Successful exploitation of the vulnerability enables RCE at the level of the server managing endpoint encryption policies.

Patches available from the vendor should be applied immediately in accordance with the official Trend Micro bulletin (KA-0019928). Until the patch is deployed, it is recommended to restrict network access to PolicyServer only from trusted hosts and to implement network segmentation.

Trend Micro Endpoint Encryption PolicyServer installed on Microsoft Windows — specific versions indicated in the vendor's references (https://success.trendmicro.com/en-US/solution/KA-0019928)