CVE-2025-0994: Trimble Cityworks Deserialization RCE

CVE-2025-0994 is a deserialization-of-untrusted-data flaw in Trimble Cityworks, a GIS-centric asset-management and permitting platform widely used by local governments and utilities, that lets an authenticated attacker achieve remote code execution on the Microsoft IIS server hosting the application — and CISA confirmed active exploitation against local-government Cityworks deployments within days of disclosure.

CVE-2025-0994 affects Trimble Cityworks, a GIS-centric work-order, asset-management and permitting platform used by municipalities, utilities and public-works departments to manage infrastructure such as water, sewer and road networks. NVD's analysis states: "Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server" (NVD).

NVD's own Primary analysis scores the flaw CVSS v3.1 8.8 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, requiring only low privileges (an authenticated Cityworks session) and no user interaction, with high impact to confidentiality, integrity and availability. CISA's own CVSS v4.0 submission scores it slightly higher at 8.6 (HIGH) (NVD).

CISA republished Trimble's advisory as ICSA-25-037-04 on 2025-02-06, confirming the same affected-version ranges and fixed versions (15.8.9, available 2025-01-28, and 23.10, available 2025-01-29), and recommending that IIS application pools running Cityworks not run with administrative privileges and that attachment directories be configured per Trimble's guidance as defense in depth. Critically, the advisory states plainly: "CISA has received reports of this vulnerability being actively exploited" (CISA ICS Advisory ICSA-25-037-04).

CISA added CVE-2025-0994 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-02-07, one day after the advisory, with a required-action due date of 2025-02-28 — an unusually short three-week window reflecting the observed in-the-wild activity against local-government infrastructure targets; known ransomware-campaign use is listed as "Unknown" (CISA KEV).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.31309 (98.274th percentile), a high figure consistent with a KEV-listed, authenticated-RCE vulnerability in internet-facing municipal infrastructure software that continues to be scanned for (FIRST EPSS).

Organizations running Cityworks should upgrade to 15.8.9 / 23.10 or later immediately, review IIS application-pool privilege configuration, and treat any Cityworks instance that was internet-exposed on a pre-fix build as a candidate for compromise investigation given the confirmed active exploitation.

• Deserialization vulnerability in Trimble Cityworks (pre-15.8.9) and Cityworks with Office Companion (pre-23.10) lets an authenticated user achieve remote code execution against the hosting IIS web server. — NVD
• NVD Primary CVSS v3.1 base score is 8.8 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; CISA's own CVSS v4.0 submission scores it 8.6. — NVD
• CISA republished the advisory as ICSA-25-037-04 on 2025-02-06, confirmed fixed versions 15.8.9 (2025-01-28) and 23.10 (2025-01-29), recommended IIS app pools not run with administrative privileges, and stated CISA had received reports of active exploitation. — CISA ICS Advisory ICSA-25-037-04
• Added to the CISA Known Exploited Vulnerabilities catalog on 2025-02-07, due date 2025-02-28; known ransomware-campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.31309 (98.274th percentile) as of 2026-10-30. — FIRST EPSS