CVE-2025-49216

The error classified as CWE-477 (use of deprecated function) allows an attacker to bypass authentication mechanisms in PolicyServer and directly invoke key methods reserved for administrators. The attack is possible remotely over the network without requiring any credentials or user interaction. An exceptionally low barrier to entry means the exploit can be carried out by anyone with access to PolicyServer.

An attacker can gain full administrative access to PolicyServer and arbitrarily modify Endpoint Encryption product configurations, which may result in bypassing disk encryption mechanisms or compromising security policies across the entire organization.

Patches available from the vendor should be applied in accordance with the references — detailed information about patched versions can be found in the Trend Micro bulletin at https://success.trendmicro.com/en-US/solution/KA-0019928. Until the patch is deployed, it is recommended to restrict network access to PolicyServer only to trusted hosts through firewall rules.

Trend Micro Endpoint Encryption PolicyServer running on Microsoft Windows — specific versions indicated in vendor references (https://success.trendmicro.com/en-US/solution/KA-0019928).