CVE-2018-6229

Think of the email encryption gateway as the front desk that applies rules to your messages. This flaw is like a “shortcut” where an attacker can trick the gateway into running their own database instructions instead of the intended rules. In the worst case, that can let them upload and run malicious code on the gateway itself, potentially taking it over.

This matters if your business runs Trend Micro Email Encryption Gateway with the 5.5 edit policy scripting/policy functionality in use. Because the attack outcome is arbitrary code execution, it’s most concerning when attackers can reach the affected capability—especially if it’s exposed to the internet or reachable from untrusted networks. There is no KEV listing here, so exploitation status is not confirmed by CISA for this CVE.

Treat this as urgent because a public exploit exists and the flaw allows attackers to execute SQL that can lead to uploading and running arbitrary code. Even without a CISA KEV listing, the combination of critical impact and publicly available exploit means you should prioritize patching/remediation promptly.

Confirm exposure

• Verify you actually use “Trend Micro Email Encryption Gateway” and whether you have “5.5 edit policy script” (or the 5.5 edit policy/policy scripting feature) enabled in your environment.
• Look for any Trend Micro configuration or deployments that reference edit policy scripting/policy management for Email Encryption Gateway 5.5.

Remediate

• Follow Trend Micro’s remediation steps for CVE-2018-6229 here: https://success.trendmicro.com/solution/1119349
• Apply the vendor’s recommended update/fix described in that solution article for your specific setup (and confirm the change is active after upgrading).

If you can’t patch immediately (temporary containment)

• Restrict network access to the Email Encryption Gateway management/policy edit capabilities so they are not reachable from the public internet or other untrusted networks.
• If you have a firewall/reverse proxy, ensure only approved admin hosts/networks can reach the relevant endpoints.

What to monitor while remediating

• Review gateway logs for signs of unexpected edit-policy activity or unusual SQL/policy changes tied to the edit policy script.
• Watch for repeated failures around policy operations, as they can indicate probing attempts.

Timing

• Because a public exploit is available and the impact is code execution, prioritize applying the vendor fix as soon as operationally possible.

Severity/impact: The weakness is CWE-89 (SQL injection). The mechanism described is that a Trend Micro Email Encryption Gateway 5.5 edit policy script can be manipulated so an attacker executes SQL commands that enable uploading and executing arbitrary code on the target system.

Exploitation status: A public exploit is available (1 known). KEV is not listed in the CISA KEV set for this CVE, so CISA-confirmed exploitation is not indicated by the findings provided.

Likelihood signal: EPSS is reported as a prediction and is not used to override exploitation status; the provided trend is rising, but public-block messaging should focus on the known exploit availability and code execution impact.

Attack vector: Network-based (attacker can reach the affected script/functionality). Privileges required and user interaction are reported as not required in the CVSS summary (no login needed per CVSS fields), making exposure and reachability key for deciding who is at risk.

Meaning of KEV (here): KEV would indicate CISA-confirmed real-world exploitation for prioritization; it is not present for this CVE in the provided findings.