CVE-2018-6228

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.09.8Critical EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2018-03-15Updated 2024-11-21Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Trend Micro Email Encryption GatewayAffected: 5.5Upgrade to: not statedStated by: CVE record
Trend Micro Email Encryption GatewayAffected: 5.5Upgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your installation is Trend Micro Email Encryption Gateway (version 5.5) and whether your policy script feature is enabled.
Open the vendor remediation and follow its steps to patch/mitigate CVE-2018-6228 for your deployment.
Verify after changes that the relevant policy script/database behavior is corrected (per vendor guidance) and that the service still operates normally.
If you cannot patch immediately, follow the vendor’s recommended workaround steps and restrict access to anything the vulnerable policy script can be reached through.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system.

In plain language

Written by AI from the record

If you run Trend Micro Email Encryption Gateway 5.5, a public SQL injection weakness could let an attacker run harmful commands—so you should check whether you’re affected and apply the vendor fix soon.

CVE-2018-6228 is an SQL injection in a Trend Micro Email Encryption Gateway 5.5 policy script that can allow attackers to execute SQL commands to upload and execute arbitrary code if they reach the vulnerable functionality.

If you're affected

Full server compromise
Arbitrary code execution
Email security service disruption
Confidential data exposure

What is it

Think of your email encryption gateway’s policy script like a set of instructions the system follows automatically. This flaw lets an attacker slip in their own “instructions” into the database commands the gateway runs. In the worst case, that can lead to attackers running code on the server or disrupting your email security services.

Who is affected

This matters if you use Trend Micro Email Encryption Gateway (including Email Encryption Gateway 5.5 policy scripts). It’s a risk when an attacker can reach the vulnerable policy script functionality in your environment. The risk depends on whether that feature is exposed/reachable from where an attacker could access it (for example, exposed interfaces or other pathways), and whether an attacker can trigger the vulnerable script.

How urgent is it

Act with urgency. Public exploit code exists, meaning attackers may be able to use this weakness without inventing new tricks. While it’s not listed in CISA KEV, this is still a serious issue (high impact potential), so you should apply the vendor remediation promptly.

What to do — in detail

Confirm whether you’re exposed

Identify the exact product and version running in your environment (Trend Micro Email Encryption Gateway / Email Encryption Gateway 5.5).
Determine whether the policy scripting feature related to the vulnerable policy script is in use and reachable in your setup (per your configuration and the vendor’s documentation).

Apply the vendor remediation

Use Trend Micro’s remediation guidance for CVE-2018-6228: https://success.trendmicro.com/solution/1119349
Follow the vendor’s steps for your deployment type (patch/upgrade or mitigation as described in the solution article).
After applying changes, confirm the service is functioning normally and that the policy script behavior is corrected according to the vendor verification guidance.

If you can’t patch immediately

Apply the workaround/mitigation steps provided by Trend Micro in the same remediation article.
Reduce exposure by restricting any network paths or interfaces that could allow an attacker to reach the vulnerable policy-script-triggering functionality (follow the vendor’s recommended controls).

What to monitor

Review logs around policy script execution or database-related errors for unusual activity after the change window.
Monitor for repeated failed attempts to trigger policy processing, especially if your environment is exposed to the internet.

KEV timing note

This CVE is not listed in CISA KEV based on the provided findings, so there isn’t KEV-based confirmation to anchor timing—but public exploit availability still supports rapid action.

Technical context

Overview and severity

CVE-2018-6228 is an SQL injection (CWE-89) in a Trend Micro Email Encryption Gateway 5.5 policy script. The flaw can allow an attacker to execute SQL commands that upload and execute arbitrary code, enabling compromise and service impact.

Attack mechanism (how it’s triggered)

An attacker must be able to reach and influence the vulnerable policy script execution path. Once reachable, injected input can be interpreted by the gateway’s SQL logic, leading to attacker-controlled SQL actions (including code upload/execution per the issue description).

Exploitation status

Public exploit code is available (2 known), indicating practical weaponization.

KEV

CISA KEV was not found to list this CVE in the provided findings.

EPSS

A predicted likelihood score was provided in the findings, but public guidance in this summary does not repeat that number because KEV/news confirmation would override it (and KEV is not listed here).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band change0 → moderateepss band change
2026-09-21EPSS band changemoderate → 0epss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → lowepss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-28EPSS band changemoderate → 0epss band change

Affected products

Trend Microcommercial · JPaka trendmicro, tmi
- Trend Micro Email Encryption GatewaySecurity Products
- Email Encryption GatewaySecurity Products

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable