CybersecurityVulnerability Management

CISA Alerts on Ongoing Exploitation of Trimble Cityworks Vulnerability Resulting in IIS RCE

Analyst 207|
CISA Alerts on Ongoing Exploitation of Trimble Cityworks Vulnerability Resulting in IIS RCE

Active Exploitation of Trimble Cityworks Vulnerability

CISA Alerts on Ongoing Exploitation of Trimble Cityworks Vulnerability Resulting in IIS RCE

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding the ongoing exploitation of a critical vulnerability in Trimble Cityworks, a GIS-centric asset management software. This vulnerability, identified as CVE-2025-0994, poses significant risks to organizations utilizing this software.

Overview of the Vulnerability

CVE-2025-0994 is classified as a deserialization of untrusted data vulnerability, which allows attackers to execute remote code on affected systems. The vulnerability has been assigned a CVSS v4 score of 8.6, indicating a high level of severity.

Key Points

  • Vulnerability Identifier: CVE-2025-0994
  • CVSS v4 Score: 8.6 (High)
  • Type: Deserialization of untrusted data
  • Impact: Remote Code Execution (RCE)
  • Active Exploitation: Confirmed in the wild

Recommendations

Organizations using Trimble Cityworks are urged to take immediate action to mitigate the risks associated with this vulnerability. Recommended steps include:

  • Applying any available patches or updates from Trimble.
  • Implementing network segmentation to limit exposure.
  • Monitoring systems for unusual activity that may indicate exploitation attempts.

Conclusion

The active exploitation of CVE-2025-0994 highlights the importance of maintaining up-to-date software and implementing robust security measures. Organizations should prioritize addressing this vulnerability to protect their systems and data from potential attacks.

CisaCyber SecurityRemote Code ExecutionVulnerability
Related Intelligence

Continue Reading

Dimly lit server room with rows of racks, one foreground rack with a warning sign.

Unpatched Microsoft Exchange Servers Exposed to Hijack Attacks

Thousands of Microsoft Exchange servers remain vulnerable to a high-severity flaw, leaving 21,899 internet-facing systems open to hijack attacks that could give attackers control of every mailbox. This unpatched authentication-bypass vulnerability, CVE-2026-62911, was fixed by Microsoft in August, but many servers still haven't been updated.

Analyst 207
Quiet Australian supermarket checkout lane with concerned cashier and customer in background holding mobile phone.

Australia's Economy Exposed to Digital System Failures

When Optus went down in 2023, the inconvenience was clear - no coffee, no lunch, no Uber - but what Australians laughed off as a minor annoyance actually exposed a much deeper vulnerability: the alarming dependence of Australia's economy on digital systems. The real issue wasn't just payments, but the entire economic exchange process, from ordering to delivery to settlement.

Analyst 207
Diverse group of people gathered around a large whiteboard in a modern conference room.

Cyber Firms' AI Defense Push Sparks Scrutiny Over Commitments

More than 200 companies, including tech giants like Microsoft and Google, have joined forces to supercharge cyber defense capabilities and shield against AI-enabled attacks. They're calling for a united front to share threat intel, track progress, and swiftly contain attacks.

Analyst 207
Modern financial building interior with laptops and tablets on a table.

Financial Stability Board Warns of AI-Driven Cyber Risks

The Financial Stability Board warns that advanced artificial intelligence could revolutionize cyber threats, potentially shaking market confidence and posing a systemic risk, especially with highly concentrated third-party service providers. Its chair, Andrew Bailey, is urging the sector and authorities to prepare for this emerging threat.

Analyst 207