Trend Micro has released patches for ten vulnerabilities in Apex Central and Endpoint Encryption (TMEE) PolicyServer, including critical-severity flaws leading to remote code execution (RCE).
The update for Apex Central resolves two critical bugs leading to RCE, tracked as CVE-2025-49219 and CVE-2025-49220 (CVSS score of 9.8). The security defects are similar, but were discovered in different methods, the company says.
Both vulnerabilities are described as an insecure deserialization operation that could allow remote attackers to execute arbitrary code on affected installations, without authentication.
Endpoint Encryption PolicyServer received fixes for eight flaws, including four critical and four high-severity defects.
Three of the critical issues are described as deserialization of untrusted data that could lead to unauthenticated RCE.
Tracked as CVE-2025-49212, CVE-2025-49213, and CVE-2025-49217 (CVSS score of 9.8), the bugs are similar, but impact different methods. The company says the first is similar to the Apex Central vulnerability CVE-2025-49220.
The fourth critical-severity vulnerability resolved in Endpoint Encryption PolicyServer, CVE-2025-49216 (CVSS score of 9.8), is an authentication bypass issue allowing “an attacker to access key methods as an admin user and modify product configurations”.
Of the high-severity flaws resolved, three are SQL injection bugs that could lead to privilege escalation, while the fourth is an insecure deserialization leading to RCE. All four require that an attacker first obtains “the ability to execute low-privileged code on the target system”.
All ten vulnerabilities were disclosed through the Zero Day Initiative (ZDI), but Trend Micro says that none of them has been observed being exploited in the wild. However, users are advised to apply the available patches as soon as possible.
Related: Palo Alto Networks Patches Privilege Escalation Vulnerabilities
Related: Fortinet, Ivanti Patch High-Severity Vulnerabilities
Related: ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Schneider, Aveva, CISA
Related: Microsoft Patch Tuesday Covers WebDAV Flaw Marked as ‘Already Exploited’
