Filestore.Fortinet Trimble Cityworks RCE Vulnerability
Article Content
- •CVE-2025-0994 allows remote code execution on affected Cityworks versions.
- •Active exploitation confirmed, with CISA listing it in the KEV catalog.
- •Users must apply the latest updates to mitigate the vulnerability.
Trimble Cityworks has a deserialization vulnerability (CVE-2025-0994) allowing authenticated users to execute remote code on affected Microsoft IIS web servers. Versions prior to 15.8.9 and Cityworks with office companion versions before 23.10 are impacted. Trimble has confirmed active exploitation of this vulnerability, prompting CISA to add it to its Known Exploited Vulnerabilities Catalog on February 7, 2025. The vulnerability has a CVSS v4 score of 8.6, indicating a high severity risk. Trimble has released updates to mitigate this flaw, and users are urged to apply these updates promptly. FortiGuard Labs has blocked known malware associated with this campaign. Organizations using affected versions are at risk of downtime and unauthorized access to their networks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Cityworks and CVE-2025-0994 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of Cityworks are affected?
Is there confirmed exploitation of this vulnerability?
What should organizations do to protect themselves?
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…