Trend Micro Fixes Critical RCE Bugs in Apex Central & TMEE PolicyServer

Recent security advisories from Trend Micro have revealed the patching of 10 vulnerabilities in its major enterprise products: Apex Central and Endpoint Encryption (TMEE) PolicyServer. This article highlights the key fixes and their implications.

Among the flaws, several critical vulnerabilities allow unauthenticated Remote Code Execution (RCE), posing a severe risk to enterprise environments. While no active exploitation has been reported, organizations are strongly urged to patch without delay.

Critical Flaws in Apex Central (CVE-2025-49219 & CVE-2025-49220)

Trend Micro Apex Central (both on-premise 2019 and SaaS versions) was found to have two critical RCE vulnerabilities: CVE-2025-49219 and CVE-2025-49220. Both issues arise from insecure deserialization practices that enable attackers to execute arbitrary code without authentication.

• CVE-2025-49219 and CVE-2025-49220 share a CVSS score of 9.8, indicating the highest level of severity.
• These vulnerabilities stem from the use of obsolete functions, categorized under CWE-477.

Although exploitation requires access to a vulnerable machine, the ease of execution and lack of authentication make these flaws particularly dangerous. Organizations should patch immediately and audit remote access and review perimeter security policies.

Quickly identify, assess, and act on vulnerabilities affecting your company systems. (SOCRadar ASM)

Protect your organization by gaining full visibility with SOCRadar’s Attack Surface Management (ASM) module. ASM continuously discovers exposed assets, misconfigurations, and shadow IT, helping your team close security gaps before attackers can exploit them.

Multiple Threats in Endpoint Encryption PolicyServer

Trend Micro Endpoint Encryption (TMEE) PolicyServer versions prior to 6.0.0.4013 are affected by eight vulnerabilities, including four marked as critical. The most concerning of these include:

• Three unauthenticated RCE bugs (CVE-2025-49212, CVE-2025-49213, CVE-2025-49217) tied to insecure deserialization.
• CVE-2025-49216, an authentication bypass issue enabling attackers to gain admin-level control.

Each of these critical flaws also holds a CVSS score of 9.8 and also falls under CWE-477, emphasizing the systemic reliance on outdated code mechanisms.

In parallel, high-severity issues include:

• SQL injection vulnerabilities (CVE-2025-49211, CVE-2025-49215, CVE-2025-49218) that can be exploited post-authentication to escalate privileges.
• A deserialization flaw (CVE-2025-49214) that requires prior low-privilege code execution.

These vulnerabilities demonstrate a wide attack surface within PolicyServer, where even partial access can lead to full system compromise.

How Can You Defend Against These Vulnerabilities?

All the vulnerabilities were responsibly disclosed through the Zero Day Initiative (ZDI). While there is no indication of active exploitation, organizations should act with urgency. Trend Micro advises customers to:

• Apply the latest security patches without delay.
• Limit access to vulnerable systems, both physically and remotely.
• Update perimeter defenses and access control policies.

For additional information, refer to Trend Micro’s official advisories:

• Apex Central Bulletin
• TMEE PolicyServer Bulletin

SOCRadar’s Vulnerability Intelligence

Given the rapid emergence of critical flaws like these, having timely and detailed vulnerability insights is vital for any security team. Tools like SOCRadar’s Vulnerability Intelligence, part of the Cyber Threat Intelligence module, can help by providing early tracking of newly disclosed CVEs and monitoring exploit trends as they unfold.

Key benefits include:

• Early detection of emerging vulnerabilities
• Continuous monitoring of exploit activity and threat actor tactics
• Prioritization support to focus on the most impactful risks

Leveraging such intelligence alongside prompt patching and strong access controls helps organizations reduce their attack surface and strengthen defenses.