What’s Vulnerable › Vulnerabilities

CVE-2025-0994: Trimble Cityworks Deserialization Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-02-07
• EPSS: 31.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-06 · updated 2026-06-17
• Weakness: CWE-502

Description

Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.

Affected products

• Trimble Cityworks: before 15.8.9; from 23.0 before 23.10 — fixed in 15.8.9, 23.10

How to fix

Upgrade to a fixed version: Trimble Cityworks 15.8.9, 23.10. Check the vendor advisory for mitigations.

References

• https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0994

Get alerted when CVE-2025-0994 or the next vulnerability affects your stack