# Trimble Cityworks deserialization RCE exploited in wild

Published: 2026-06-09 · Severity: high · Sectors: government-national, infrastructure
Canonical: https://vorant.io/reports/c6b549aa-a75f-53a8-ae49-dad10432b727/trimble-cityworks-deserialization-rce-exploited-in-wild

> Authenticated deserialization flaw in Trimble Cityworks allows remote code execution; actively exploited.

A deserialization vulnerability in Trimble Cityworks, a GIS-based asset management system widely used in government and public infrastructure, permits authenticated attackers to execute arbitrary code on affected Microsoft Internet Information Services (IIS) web servers. CISA reports active exploitation in the wild. The vulnerability affects Cityworks versions prior to 15.8.9 and Cityworks with Office Companion versions prior to 23.10. Successful exploitation allows an attacker to install programs, view, change, or delete data within the privilege context of the compromised account; administrative accounts pose the highest risk. The attack requires authentication but no user interaction. Defenders should prioritize patching affected versions immediately, enforce least-privilege access controls, segment network infrastructure to isolate critical systems, and conduct vulnerability scanning to identify affected deployments.

## Mentioned in this report

- Vulnerabilities: CVE-2025-0994 (KEV)

## Detection guidance (public sample)

### IIS Worker Process Spawning Command Shell or Script Host

ATT&CK: T1190

w3wp.exe spawning cmd, PowerShell or script hosts - typical post-exploitation of a deserialization RCE against an IIS-hosted app such as Cityworks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Command Shell or Script Host
description: Detects the IIS worker process w3wp.exe spawning an interpreter (cmd,
  PowerShell, mshta, wscript, cscript). This is the usual process pattern after exploiting
  a deserialization RCE in an IIS-hosted application such as Trimble Cityworks, and
  it also matches webshell use. Generalises on the parent/child relation, not on a
  specific payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection
falsepositives:
- Legacy IIS web applications that deliberately shell out to cmd.exe for batch jobs
- Administrative web apps that invoke PowerShell for management tasks
level: medium
id: 6289c4ab-008a-533f-bc80-7dabb2c850a2
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-trimble-cityworks-could-allow-for-remote-code-execution_2025-014
```

### IIS Worker Process Spawning Download or Staging Tool

ATT&CK: T1104

w3wp.exe spawning certutil, bitsadmin, curl or PowerShell download cradles to fetch a second-stage payload after exploitation of an IIS-hosted app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Download or Staging Tool
description: Detects w3wp.exe launching file-transfer utilities or PowerShell download
  cradles, indicating a multi-stage intrusion where the initial web exploit (such
  as the Cityworks deserialization RCE) pulls down further tooling.
tags:
- attack.command-and-control
- attack.t1104
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \w3wp.exe
  selection_img:
    Image|endswith:
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
  selection_cli:
    CommandLine|contains:
    - DownloadString
    - DownloadFile
    - Invoke-WebRequest
    - Net.WebClient
    - Start-BitsTransfer
    - urlcache
    - 'iwr '
  condition: selection_parent and (selection_img or selection_cli)
falsepositives:
- Web applications that legitimately call curl.exe to reach internal APIs
level: high
id: e9852e6f-c4d0-59cf-8da0-95c7a3f6ebea
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-trimble-cityworks-could-allow-for-remote-code-execution_2025-014
```

### IIS Worker Process Spawning Reconnaissance Commands

ATT&CK: T1190

w3wp.exe spawning whoami, systeminfo, net, nltest, etc. indicating hands-on-keyboard discovery after web application exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Reconnaissance Commands
description: Detects the IIS worker process spawning host and domain discovery utilities.
  After exploiting an IIS-hosted app (for example Cityworks), attackers commonly check
  their privilege context and the environment first.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \whoami.exe
    - \systeminfo.exe
    - \ipconfig.exe
    - \nltest.exe
    - \net.exe
    - \net1.exe
    - \quser.exe
    - \tasklist.exe
  condition: selection
falsepositives:
- Web-based server monitoring or diagnostics pages that run ipconfig or tasklist
level: high
id: 94b128f6-5a16-53cd-b4a7-8f6315f5fca2
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-trimble-cityworks-could-allow-for-remote-code-execution_2025-014
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-trimble-cityworks-could-allow-for-remote-code-execution_2025-014

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c6b549aa-a75f-53a8-ae49-dad10432b727/trimble-cityworks-deserialization-rce-exploited-in-wild.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup