CVE-2025-0994: Trimble Cityworks Deserialization Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 1 day after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 31.1%
EPSS score, percentile 98.3 of all scored records
- How severe?
- 8.6 High
CVSS v4.0 base score, given by the CNA
- What should I do?
CISA deadline . Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Which versions are affected?
Affected
- before 15.8.9
- before 23.10
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: .
Solution (from the CVE record)
Trimble will be releasing updated versions to both 15.x (15.8.9 available January 28, 2025) and Cityworks 23.x software releases (23.10 available January 29, 2025). Information on the updated versions will be available through the normal channels via the [Cityworks Support Portal]( https://cityworks.my.site.com/)(Login required). On-premise customers should install the updated version immediately. These updates will be automatically applied to all Cityworks Online (CWOL) deployments.
Workaround (from the CVE record)
Trimble has observed that some on-premise deployments may have overprivileged Internet Information Services (IIS) identity permissions. For avoidance of doubt, and in accordance with Trimble's technical documentation, IIS should not be run with local or domain level administrative privileges on any site. Please refer to the direction in the latest release notes in the [Cityworks Support Portal]( https://cityworks.my.site.com/)(Login required) for more information on how to update IIS identity permissions. Trimble's CWOL customers have their IIS identity permissions set appropriately and do not need to take this action. Trimble has observed that some deployments have inappropriate attachment directory configurations. Trimble recommends that attachment directory root configuration should be limited to folders/subfolders which only contain attachments. Please refer to the direction in the latest release notes in the [Cityworks Support Portal]( https://cityworks.my.site.com/)(Login required) for more information on how to ensure proper configuration of the attachment directory.
Advisories and patches
Linked from CISA's catalog entry
- https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04
- https://nvd.nist.gov/vuln/detail/CVE-2025-0994
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | before 15.8.9 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 23.10 |
Versions not listed are: unaffected.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.
Summary: CISA's KEV catalog, as of .
- CISA added CVE-2025-0994 to its Known Exploited Vulnerabilities (KEV) catalog on 7 Feb 2025.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 28 Feb 2025.
- The CVE record was published on 6 Feb 2025, 1 day before it was added to KEV.
- The CVE record carries a CVSS v4.0 base score of 8.6 (High), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 31.1% (percentile 98.3), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
Weakness
- CWE-502: Deserialization of Untrusted Data
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| Added to CISA KEV | |
| CISA due date for the required action | |
| CVE record last updated |