This vulnerability (CWE-502) affects Trimble Cityworks software before versions 15.8.9 and Cityworks with office companion before 23.10. It involves deserialization of untrusted data, which can be exploited by an authenticated user to achieve remote code execution on the IIS web server running the application. The CVSS 4.0 score is 8.6, indicating a high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory details are provided in the input, and the product is not a cloud service.

Successful exploitation allows an authenticated attacker to execute arbitrary code remotely on the affected IIS web server, potentially compromising the server and any data or services it hosts. This can lead to full system compromise, data breaches, or service disruption. The vulnerability requires authentication but has a low complexity and no user interaction, increasing risk in environments where user credentials may be compromised or misused.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to the minimum necessary and monitor for suspicious activity related to deserialization processes. Avoid exposing the affected application to untrusted networks if possible.