CVE-2025-49219

CWE-477 CWE-502 — Deserialization of Untrusted Data3 documents3 sources

Severity

9.8CRITICAL

EPSS

9.2%

top 7.29%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Trend Micro, Inc. Trend Micro Apex Central Trendmicro Apex Central

Timeline

PublishedJun 17

Description

An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5trend_micro,_inc./trend_micro_apex_central8.0 — 8.0.7007

▶NVDtrendmicro/apex_central2019

🔴Vulnerability Details

CVEList

CVE-2025-49219: An insecure deserialization operation in Trend Micro Apex Central below versions 8↗2025-06-17

▶

GHSA

GHSA-xfcv-jhfx-64pp: An insecure deserialization operation in Trend Micro Apex Central below versions 8↗2025-06-17

▶