CVE-2025-60036
Published: 18 February 2026
Summary
CVE-2025-60036 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Bosch Rexroth Indraworks. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-60036 is a deserialization vulnerability (CWE-502) in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. The flaw enables arbitrary code execution when the application parses a manipulated file containing malicious serialized data.
Exploitation requires local access (AV:L) with low complexity (AC:L) and no privileges (PR:N), but user interaction (UI:R) is necessary, such as opening a specially crafted file. A successful attack leads to remote code execution (RCE) on the system running UA.Testclient, resulting in high confidentiality, integrity, and availability impacts (C:I:A:H) and a CVSS v3.1 base score of 7.8.
For mitigation details, refer to the Bosch PSIRT security advisory at https://psirt.bosch.com/security-advisories/BOSCH-SA-591522.html. The vulnerability was published on 2026-02-18.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207844
Vulnerability details
A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file…
more
containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running the UA.Testclient.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization vulnerability (CWE-502) in UA.Testclient enables arbitrary code execution via exploitation of a client application by parsing a manipulated file (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching and remediation of known flaws like this deserialization vulnerability in UA.Testclient prior to version 15V24.
Enforces validation of file inputs to the UA.Testclient utility, preventing processing of malicious serialized data that leads to RCE.
Deploys malicious code protection mechanisms to scan and block files containing deserialization payloads before execution in the affected application.