CVE-2025-60038 Deserialization in IndraWorks
An attacker can execute arbitrary code on a user's system by tricking them into opening a malicious file in Rexroth IndraWorks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-60038?
CVE-2025-60038 is a high-severity unsafe deserialization vulnerability in Bosch Rexroth IndraWorks, published on 18 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running Rexroth IndraWorks.
Weakness: CWE-502
Which versions are affected by CVE-2025-60038?
It affects 1 product.
Products include Bosch Rexroth Indraworks.
How do I fix CVE-2025-60038?
No fix has been published for CVE-2025-60038 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-60038 being exploited?
There is no known exploitation of CVE-2025-60038 in the wild and no public exploit code.
Other vulnerabilities in Bosch Rexroth IndraWorks
Sources
Also known as GHSA-wq2g-h2h9-v8x3.