SQL Injection Privilege Escalation in Trend Micro Endpoint Encryption PolicyServer

Successful exploitation can allow an attacker who already has low-privileged code execution on the target system to elevate privileges on the affected PolicyServer installation. In practical terms, this can expand an initial foothold into higher-privileged access and may contribute to broader compromise when chained with other vulnerabilities affecting the product.

If immediate patching is not possible, reduce exposure by restricting local and remote avenues that could provide attackers with low-privileged code execution on the host, limiting access to the PolicyServer system to trusted administrators and management paths, hardening the underlying server, and monitoring for abnormal database-related application behavior or unexpected privilege changes. Because exploitation requires an existing foothold, prioritizing controls that prevent initial code execution materially reduces risk until patching is completed.

Upgrade Trend Micro Endpoint Encryption PolicyServer to a fixed release. Available guidance indicates affected versions older than 6.0.0.4013 should have Patch 1 Update 6 applied. Organizations should follow the vendor's June 2025 security bulletin and verify the update has been successfully deployed across all PolicyServer instances.