Trimble Cityworks Deserialization Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 07/02/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| cityworks | ≥ 23.0, < 23.10< 15.8.9 | 23.1015.8.9 |
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free