CVE-2025-49220
published 2025-06-17CVE-2025-49220: An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.93%
77.4th percentile
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| trend_micro_inc | trend_micro_apex_central | >= 8.0 < 8.0.7007 | 8.0.7007 |
| trend_micro_inc | trend_micro_endpoint_encryption_policy_server | >= 6.0 < 6.0.0.4013 | 6.0.0.4013 |
| trendmicro | apex_central | — | — |
| trendmicro | trend_micro_endpoint_encryption | < 6.0.0.4013 | 6.0.0.4013 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mp4q-gcm4-ww9c: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on
ghsa_unreviewed·2025-06-17·CVSS 9.8
CVE-2025-49212 [CRITICAL] CWE-477 GHSA-mp4q-gcm4-ww9c: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.
GHSA
GHSA-vmw3-xqx8-h247: An insecure deserialization operation in Trend Micro Apex Central below version 8
ghsa_unreviewed·2025-06-17·CVSS 9.8
CVE-2025-49220 [CRITICAL] CWE-477 GHSA-vmw3-xqx8-h247: An insecure deserialization operation in Trend Micro Apex Central below version 8
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
GHSA
GHSA-xfcv-jhfx-64pp: An insecure deserialization operation in Trend Micro Apex Central below versions 8
ghsa_unreviewed·2025-06-17·CVSS 9.8
CVE-2025-49219 [CRITICAL] CWE-477 GHSA-xfcv-jhfx-64pp: An insecure deserialization operation in Trend Micro Apex Central below versions 8
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.
No detection rules found.
No public exploits indexed.
2025-06-17
Published